Document Better Auth browser authentication

[ColeMurray]

Summary

• add a July 26 changelog entry for the Better Auth browser-authentication cutover
• document control-plane-owned sessions, GitHub and optional Google sign-in, and the signed web proxy
• call out the required sign-in after legacy browser tokens are retired

Why

The Better Auth runtime and full browser-authentication cutover merged in #1125 and #1126, but the user-facing changelog did not yet describe the change or its upgrade impact.

Validation

• prettier --check CHANGELOG.md
• git diff --check
• confirmed the change adds no Markdown links requiring target validation

Summary by CodeRabbit

• New Features

  • Improved browser authentication with more secure, control-plane managed sessions.
  • Added signed authentication routing for browser sign-in requests.

• Breaking Changes

  • Legacy browser tokens are no longer supported.
  • Existing users must sign in again after upgrading.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 54568d54-c835-4232-9908-205254e45319

📥 Commits

Reviewing files that changed from the base of the PR and between 654396c and 492e507.

📒 Files selected for processing (1)

• CHANGELOG.md

🚧 Files skipped from review as they are similar to previous changes (1)

• CHANGELOG.md

---

📝 Walkthrough

Walkthrough

Adds a July 26, 2026 changelog entry documenting Better Auth browser sessions, signed proxy route allowlisting, dual request authentication, and retirement of legacy browser tokens.

Changes

Better Auth browser authentication

Layer / File(s)	Summary
Document authentication model CHANGELOG.md	Adds a dated entry describing control-plane-owned browser sessions, signed proxy authentication routes, dual request requirements, and legacy token retirement.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• ColeMurray/background-agents#1125: Introduces the Better Auth browser-auth runtime and D1 schema referenced by this changelog entry.

Suggested reviewers: open-inspect

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: documenting the Better Auth browser authentication cutover.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/changelog-better-auth

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[open-inspect]

Summary

PR #1131, "Document Better Auth browser authentication" by @ColeMurray, updates the changelog with a July 26 Better Auth browser-authentication entry. Reviewed 1 changed file with +8/-0; this is documentation-only and looks accurate and maintainable.

Critical Issues

None found.

Suggestions

None.

Nitpicks

None.

Positive Feedback

The entry clearly calls out the user-visible authentication change, provider support, signed proxy behavior, and the required re-sign-in after legacy browser tokens are retired.

Questions

None.

Verdict

Approve.

Validation: npx prettier --check CHANGELOG.md passed, and git diff --check main...HEAD reported no whitespace issues.

[open-inspect]

Updated the changelog wording to say browser resource requests require both the signed web-service channel and the browser session, avoiding the broader implication that all application requests require browser state.

Validation: npx prettier --check CHANGELOG.md passed. Pushed commit 492e507 to docs/changelog-better-auth.