Better Auth redirects to the login page with the original signed authorize params;
hand them back to /oauth2/authorize as the post-sign-in callback so a code is
issued (was defaulting to '/', producing a blank page).
Current OAuth 2.1 provider plugin (versioned with core, 1.6.23). Bundles JWT
(access tokens verifiable at /jwks), DCR via /oauth2/register incl. unauthenticated
registration (MCP clients register before they have creds), skipConsent since
sign-in is the authorization for a personal connector.
- Explicitly track latest core (1.6.23); the @better-auth/cli lags at 1.4.21 and
pulled a second core copy — replaced with a getMigrations() script on the same
version (src/migrate.ts).
- CI build job matches the proven pattern (no setup-buildx; plain build/push).
DCR-capable (RFC 7591) OAuth authorization server so Claude's MCP connector
self-registers — the thing Authentik can't do until 2026.8.0. Users sign in with
Google/Apple; oidcProvider + jwt issue asymmetric JWTs (JWKS) the MCP server
verifies. Shares the existing CNPG Postgres (own `betterauth` schema).
Scaffold: auth config, minimal Node server + login page, Dockerfile, CI.
Chris Farhood