Auth & Identity

Drop-in authentication, user management, and identity infrastructure for modern apps.

This week's digestOct 5 – 11, 2026

Clerk's directory sync gets role mapping as Auth0 opens up token scopes

Clerk shipped a role-mapping step for self-serve Directory Sync and let SAML connections trust several signing certificates at once, while Auth0 took access token scope customization for Actions to general availability.

Read the digest70 releases covered

In this issue

01Enterprise identity gets more forgiving

Clerk

Auth03 releases 02Client-side fixes and the iOS session model

Clerk9 releases

EarlierSep 28Auth SDKs ship a security-heavy week of account-takeover fixes and enterprise SSO controls Sep 21Enterprise SSO gets more flexible as middleware patches a credential leak All digests →

Week of Oct 12in progress · digest Monday

FriOct 16, 202619 releases

Daily summary

Clerk adds JWT issuer validation and Expo SDK 58 support

Clerk shipped optional issuer-claim validation across its JWT verification APIs alongside Expo SDK 58 support for its mobile and biometrics packages, while Better Auth added a FedCM browser account chooser for Google sign-in.

Clerk's JWT verification now accepts an optional issuer option, letting apps validate the iss claim against an allowlist in verifyJwt, verifyToken, and authenticateRequest.
Clerk's Expo packages, including expo, expo-biometrics, expo-passkeys, and expo-google-signin, now support Expo SDK 58, fixing iOS and Android build failures on the new version.
Clerk fixed OAuth prompt handling so oidcPrompt values like select_account now reach the provider in signIn.sso and authenticateWithRedirect, and stopped session.getToken from skipping refreshes when navigator.onLine falsely reports offline.
Better Auth now shows a browser account chooser for Google sign-in via FedCM on supported Chrome browsers, and its Drizzle adapter preserves required fields in relations v2 schemas.
Clerk's UserButton in combined mode now defaults to a larger trigger badging the active organization; triggerVariant='condensed' restores the previous look.

Clerk19

ThuOct 15, 20261 release

Daily summary

Better Auth reworks device-code approval and OAuth grants

Better Auth rewrote device-code approval to run through the provider's sign-in and consent flow and added CIBA backchannel authentication and OAuth token exchange, while Clerk fixed an iOS sign-out bug and shipped a new organization switcher in its Mosaic UI.

Better Auth's device-code approval now runs through the OAuth provider's sign-in and consent flow, requiring migration of the DeviceAuthorizationGrant interface and new deviceCode columns; CIBA backchannel auth and OAuth token exchange are also added.
Clerk's Expo SDK stops signing iOS users out when a keychain read fails transiently, retrying once the app is active instead of deleting the stored client token.
Clerk's Mosaic UserButton drops its organization mode in favor of combined or user, with a separate OrganizationSwitcher export for org-only switching.
Clerk's Backend User object now exposes a deprovisioned field, distinguishing Directory Sync deactivation from banning in user.updated webhooks.
Better Auth fixed MongoDB findMany pagination repeating or skipping results under ID sorting and capped JWKS refetches for unknown key IDs.

Auth01

Universal Login: "Continue with" entry; phone country rules

Universal Login now offers Early Access identifier controls on all plans, letting tenants choose type-specific login entry with "Continue with" buttons or keep the default unified field, configured via the theme API. Phone entry for login and signup adds country selection, regional formatting, and numeric keyboard and phone number suggestions on supported devices, with supported countries set through tenant-level include or exclude lists.

Details