BetaWeekly digests are a beta — we're trying something new. Feedback welcome.
Auth & Identity weekly digests
- Week of October 12, 2026Clerk's Expo SDK breaks into native pieces while Better Auth patches the edges
The Clerk JavaScript SDK split its Expo native components into a new package that apps must now install, and added Expo SDK 58 support across its companion packages, while Better Auth cleaned up stale sessions, reset links, and DPoP behind proxies. Clerk also brought its MCP server into account context, and Auth0 opened Early Access identifier and phone-country controls for Universal Login.
- Week of October 5, 2026Clerk's directory sync gets role mapping as Auth0 opens up token scopes
Clerk shipped a role-mapping step for self-serve Directory Sync and let SAML connections trust several signing certificates at once, while Auth0 took access token scope customization for Actions to general availability.
- Week of September 28, 2026Auth SDKs ship a security-heavy week of account-takeover fixes and enterprise SSO controls
Better Auth patched a critical Magic Link account-takeover vulnerability, Clerk made Directory Sync self-serve for organization admins and added an SSO bypass for locked-out enterprise users, while Auth0 warned that refresh tokens are about to get longer and Clerk's JavaScript SDK rolled a Protect-challenge overhaul out across every framework package.
- Week of September 21, 2026Enterprise SSO gets more flexible as middleware patches a credential leak
Multiple enterprise connections per Organization arrive in Clerk, alongside a cross-request credential leak fix in clerkMiddleware and a cleaner blocked-request experience across its SDKs. Better Auth lands captcha and banned-user messaging, while Supabase's auth server churns through release candidates.
- Week of September 14, 2026Enterprise identity gets real-time sync, fallback sign-in, and custom IDs
Auth0 opened Early Access for B2B Connect with real-time directory sync and pushed custom user IDs into Actions, while Clerk shipped self-serve Directory Sync across its SDKs alongside an SSO fallback sign-in for enterprise users whose IdP is unreachable.
- Week of September 7, 2026Auth platforms split their week between MFA recovery, device flows, and enterprise traffic rules
Supabase Auth began laying the groundwork for MFA recovery codes, Clerk rolled out the OAuth 2.0 device authorization grant for CLIs and TVs, and Auth0 added a Deny All fallback rule to its tenant ACL. Clerk's SDK packages also spent the week rolling out offline sign-out and OIDC parameters across every framework it ships.
- Week of August 31, 2026Clerk ships OAuth device flow everywhere, Better Auth restores its 1.6 schema, and Auth0 opens self-service XAA
Clerk brought OAuth Device Authorization Grant approval to every JavaScript framework it supports, Better Auth rolled back its 1.7 account schema to spare existing users a backfill while adding Cloudflare sign-in, and Auth0 put third-party app access and Cross App Access configuration in the hands of organization admins.
- Week of August 24, 2026Identity platforms open up token exchange, audit trails, and biometric sign-in
Auth0 made Custom Token Exchange generally available and began acting as the requesting app in Cross-App Access flows, while Clerk opened Admin Logs audit trails, let teams tune the reverification window, and brought biometric credentials and passkeys to mobile.
- Week of August 10, 2026Migration season: flexible passwords, zero-downtime SCIM, and a safer surface
Auth0's Flexible Password Policy went GA, WorkOS shipped a zero-downtime SCIM migration bridge, and Better Auth continued hardening its OAuth device grant. Clerk rounded out the week with a cluster of OAuth flow and native SDK fixes.
- Week of July 27, 2026Agent identities, self-serve SSO, and org-scoped controls
Auth0 gave AI agents first-class identities and launched Privileged Worker for token retrieval, while Clerk made self-serve OIDC SSO generally available. Both platforms also shipped new organization-level access controls.
- Week of July 20, 2026Better Auth overhauls account identity, Clerk cuts Astro middleware
Better Auth shipped a breaking 1.7.0 release candidate that renames account fields and moves join configuration, while Clerk's Astro v4.0.0 removes middleware-based route matching and drops Astro 4 support. Both platforms also shipped critical fixes for OAuth flows, session caching, and identity synchronization.
- Week of July 13, 2026Security hardening at the foundation
Clerk patched a stored XSS vector in SSR script tags, locked down IPC origin validation in Electron, and announced TLS cipher suite deprecation, while the Clerk JS SDK gained timeout-based failure recovery for slow Frontend API endpoints.
- Week of July 6, 2026Hardening access: enforcement, federation, and fraud prevention
Auth0’s third-party apps for Organizations reached GA, Clerk enforced a token claim bypass, and both platforms added new fraud and federation controls.
- Week of June 29, 2026Browsers, bots, and billing
WorkOS shipped a browser-facing GraphQL API and an MCP server for AI management, Auth0 pushed SCIM provisioning to downstream apps via Event Streams, and Clerk added account credits UI and OAuth token revocation.
- Week of June 22, 2026Self-serve SSO and multi-project orgs reshape enterprise auth
WorkOS launched multiple Projects, Clerk enabled self-serve SSO for customer IT admins, and better-auth shipped a major OAuth provider restructuring — enterprise-grade auth capabilities moved further into developer tooling this week.
- Week of June 15, 2026OAuth consent comes home and Clerk enforces auth at lint time
Clerk ships a hostable OAuth consent component, an experimental ESLint plugin that catches unprotected Next.js routes, and exclusive organization membership, while Better Auth fixes OIDC claim overrides and Auth0's Refresh Token Metadata reaches GA for Enterprise customers.
- Week of June 8, 2026Better Auth hardens concurrent flows while Clerk standardises metadata APIs
Better Auth shipped fixes for dozens of race conditions and replay vulnerabilities across authentication flows, while Clerk deprecated unsafeMetadata in favour of dedicated updateMetadata methods and added new metadata replacement APIs to its backend SDK.
- Week of June 1, 2026The week M2M went multi-tenant and SCIM closed the loop
Auth0 shipped machine-to-machine access for third-party applications and made Inbound SCIM Groups generally available, while Clerk rolled out prebuilt organization management UI across its native mobile SDKs and a major backend API update.
- Week of May 25, 2026Debugging emails, hardening auth, and SSO everywhere
Clerk launched Email Logs in public beta for debugging delivery issues, while Better Auth patched several high-severity security flaws. Auth0 shipped GA passkeys with cross-subdomain support and organization-scoped Token Vault, and Clerk added self-serve SSO configuration across its SDKs.
- Week of May 18, 2026Js-cookie security fix ripples across every Clerk SDK
Every Clerk JavaScript SDK patched this week to upgrade js-cookie to 3.0.7, addressing a cross-site scripting vulnerability. Meanwhile, a new UI helper fixes subscription button visibility for seat-based plans without a base fee.
- Week of May 11, 2026Clerk patches a Next.js bypass, ships SSO UI, and adds metadata updates
The week's biggest story is a high-severity Next.js App Router middleware bypass fixed in Clerk's Next.js SDK, while across the JavaScript monorepo the team shipped SAML SSO configuration steps, user metadata APIs, new UI customization options, and a WorkOS feature flags runtime client.