Better Auth

What it is

Better Auth is a code library that handles "authentication": signing people up, logging them in, keeping them logged in, and resetting passwords. It runs inside your own app and stores users in your own database, unlike a hosted service such as Clerk, which keeps your users on its servers and charges per active user.

On top of email and password it has add-ons (called plugins) for Google and GitHub sign-in, magic links, passkeys, two-factor codes, organizations with roles, Stripe billing and more.

It's free and MIT-licensed. It became the default choice for many Next.js developers in about two years: the team took over maintenance of Auth.js (formerly NextAuth) in September 2025 and now recommends Better Auth for new projects. In July 2026 the team joined Vercel, which says it will keep the library open source and not tied to any one framework or host.

What actually happens when you use it

1. Install and configure. You add the package, a secret key and your site's URL, and create one auth.ts file that turns on the login methods you want.
2. Create the tables. A command-line tool generates the user, session and account tables for your database, or a schema file for Drizzle or Prisma.
3. Mount the routes. One catch-all route (usually /api/auth/...) handles every sign-in, sign-out and callback.
4. Use it in the front end. A small client gives your pages signIn, signUp and a useSession hook to check who's logged in.
5. Add plugins as you grow. Two-factor, teams or billing are a few lines each, though each one usually adds database tables you'll need to migrate.

For agents, the site publishes an llms.txt index and a docs MCP server split by version, so your agent can read the docs for the release you have instead of guessing.

What people like

• Your users live in your database. Developers on Hacker News like that it's a library, not a service: if you outgrow it or it changes direction, the data is already yours.
• It's cheaper and steadier than a hosted service. Val Town left Clerk partly because its outages made their whole site unusable; with Better Auth, sessions no longer depend on a third party staying online. Another developer who switched from Clerk called it more reliable and much cheaper.
• Plugins cover a lot without custom code. One builder set up anonymous users, organizations, multi-tenancy and several sign-in options without writing special code. Others value how hackable it is compared with a closed service.
• Security reports are handled in the open. It has published dozens of security advisories, each with a plain "Am I affected?" section and the version that fixes it. That's a lot of fixes, but they're disclosed clearly.

What people run into

• Updates break things, sometimes silently. In September, version 1.7 changed how accounts are matched, and one SaaS owner found out from support tickets that every login had stopped working with no error in the logs. Version 1.7.3 then reverted the change in a patch release, so people who had fixed it had to undo their fix.
• Version numbers don't signal risk. A July issue titled "stop breaking everything on minor releases" drew a maintainer reply: "We're aware this doesn't strictly follow semver, and that's intentional." Another issue made the same complaint about 1.7.3. A Hacker News user also said breaking changes in patch versions are more common than in most packages.
• A steady flow of security fixes. By our count, 31 advisories were published in the last 12 months, 3 rated critical and 19 high. Many are in optional plugins like SSO, SCIM and the OAuth provider. The most recent critical one, fixed in 1.7.7 on 2026-09-30, let an attacker sign in as another user on apps using magic links together with social login.
• Docs can run ahead of releases. One user followed the 1.7 upgrade guide and hit errors because it described a version that wasn't out yet.
• Split front end and back end is fiddly. People hosting the front end and API on different free domains report Google sign-in and cookie problems. Replies point to configuration, not bugs, but it's a common wall.
• Code quality is debated. One experienced developer said it felt rushed with few tests when they first looked, though improving. The Vercel news also left some worried about future lock-in, with no sign of it so far.

Before you install

• Pin the exact version. Remove the ^ in package.json so your agent or a bot can't pull in a breaking release. Update on purpose, after reading the release notes, which is what burned users now do.
• But do update for security fixes. Watch the advisories page and check the "Am I affected?" section against the plugins you use.
• Add one real login test. Several people in the 1.7 thread recommend a synthetic login check: a script that logs in with a test account and loads a signed-in page. It catches silent breakage that error logs miss.
• Turn on only the plugins you need. Each one adds tables, settings and, judging by the advisory list, possible security exposure.
• Consider a hosted service if you'll never look at it. If nobody will read changelogs or run a test after updates, a managed service like Clerk trades money for less upkeep.

The short version

Better Auth gives you the features of a paid login service for free, with the data in your own database, and it's where most of the TypeScript world has landed. The catch is upkeep: releases have broken logins without a version-number warning, and security fixes come often. Pin it, test logins, and update deliberately, and it's a solid foundation.