{"collection":{"slug":"auth-identity","name":"Auth & Identity"},"digest":{"id":"cwd_VfQ_gB9LlRgSa4dJi1cBu","weekStart":"2026-06-22","title":"Self-serve SSO and multi-project orgs reshape enterprise auth","intro":"WorkOS launched multiple Projects, Clerk enabled self-serve SSO for customer IT admins, and better-auth shipped a major OAuth provider restructuring — enterprise-grade auth capabilities moved further into developer tooling this week.","body":"### Enterprise configurations go self-serve\n\nThe week's most significant shift came from [Clerk's self-serve SSO](/release/rel_CgIkinC5LsRgHFxm6zfQ5-clerk-adds-self-serve-sso-for-customer-it-admins), which lets customer IT admins configure their own enterprise SSO connections — supporting Okta, Google Workspace, Microsoft Entra ID, and custom SAML — directly from an `OrganizationProfile` security tab. This removes the burden of managing per-customer SSO setup from your team. Across Clerk's JavaScript SDK, the [@clerk/shared](/release/rel_IMY3v_DloK3wDl4dfensU-clerk-shared-v4-22-0-handles-expired-organization-domains-in-self-serve-sso) and [@clerk/ui](/release/rel_TTGfsUBHeqQpLFWHZuWxn-clerk-javascript-sdk-clerk-ui-1-23-0-fixes-sso-wizard-state-loss-and-adds-drag) packages now handle expired organization domains in the self-serve flow gracefully, triggering re-verification instead of blocking. The [@clerk/eslint-plugin](/release/rel_clfvMHC_Q2c-TbQVx3bSC-clerk-eslint-plugin-0-2-0-changes-glob-matching-to-project-root) also shipped a breaking change to its `require-auth-protection` rule: globs now resolve from the project root rather than `app/`, so projects using `src/app/` must update their patterns.\n\n[WorkOS introduced multiple Projects](/release/rel_RdjmDExD12i8WtwVVNMTp-workos-introduces-multiple-projects-and-per-environment-branding) within a single organization, each with its own API keys, users, directory sync configs, and audit logs — plus per-environment branding (logo, colors, custom domain). This pairs naturally with their new [waitlist management feature](/release/rel_xplBMAPtMJ_r-rwFcOFWX-workos-launches-waitlist-management-feature), which lets teams gate sign-ups for beta launches directly through AuthKit.\n\n### better-auth restructures its OAuth foundation\n\n[Better Auth v1.7.0-rc.0](/release/rel_wzlkEdnvJ_OqwNjco_OT1-better-auth-v1-7-0-rc-0-overhauls-oauth-provider-renames-mcp-apis-and-adds-back) is the second pre-release toward 1.7 and brings deeper changes. The OAuth provider gains back-channel logout (revoking tokens on session end), explicit OAuth resource modeling, and the MCP module ships as its own package with renamed APIs (`requireMcpAuth`, `createMcpResourceClient`). Two-factor enablement now returns a discriminated response accepting an OTP method. The default trusted-proxy behavior also changes to ignore `x-forwarded` headers, and PKCE S256 is now enforced for Electron auth.\n\nAcross [v1.7.0-beta.10](/release/rel_rLmOW5Eb65NNHpcPFpNqK-better-auth-v1-7-0-beta-10-enforces-rate-limiting-before-plugins-and-revokes) and [v1.6.22](/release/rel_ajozD1TPRH_g-vPLiLZV0-better-auth-v1-6-22-fixes-unproven-credential-revocation-and-wrong-org), several important fixes landed: rate limiting now runs before plugin handlers, unproven credentials are revoked after magic link or email OTP sign-in, and account lockout is enforced after repeated two-factor failures. Session permission revocations now take effect immediately even with cookie caching enabled, and server-side OAuth requests refuse to follow redirect responses.\n\n### Clerk's platform updates: cross-tab stability and iOS alignment\n\n[@clerk/clerk-js v6.22.0](/release/rel_jCQmWRmLoo3dNsIfKlAtk-clerk-clerk-js-6-22-0-prevents-cross-tab-broadcast-from-dropping-session-tokens) fixed a subtle cross-tab broadcast failure that was evicting freshly cached session tokens — now a failed broadcast no longer discards valid tokens, reducing unnecessary `getToken()` network requests. On the Expo side, [@clerk/expo v3.6.0](/release/rel__tuMtv1kqhlbxszvN_T44-clerk-expo-v3-6-0-aligns-ios-native-module-with-expo-modules-deprecates-google) aligns iOS native module registration with Expo Modules (matching Android), and deprecates native Google Sign-In in favor of the separate `@clerk/expo-google-signin` package coming in the next major version. [Version 3.6.1](/release/rel_6BpnscciXJiiqdM0jdRT6-clerk-expo-sdk-v3-6-1-adds-native-theme-colors-for-sso-buttons) added native theme color support for SSO button configurations. The [iOS SDK 1.2.6](/release/rel_SSd7YJSxztOaWeEDCRwri-clerk-ios-sdk-1-2-6-gates-apple-sign-in-by-sign-up-mode-adds-native-dev) gates Apple sign-in transfer by sign-up mode and renders a development mode indicator natively.\n\nThe [@clerk/ui package v1.23.0](/release/rel_TTGfsUBHeqQpLFWHZuWxn-clerk-javascript-sdk-clerk-ui-1-23-0-fixes-sso-wizard-state-loss-and-adds-drag) fixes a frustrating bug where the self-serve SSO configuration wizard lost its place when organization data refetched mid-flow — the wizard now stays on its current step. It also adds drag-to-upload support in AvatarUploader and improves Tab element focus ring visibility for keyboard navigation.\n\n### Maintenance across the ecosystem\n\nA wave of dependency bumps rolled through Clerk's SDKs this week, with `@clerk/shared` moving to v4.22.0 across nearly every package. Clerk also published corrected [Electron passkeys platform packages](/release/rel_MGN0lgx3-YMJuftRJDEed-clerk-javascript-sdk-publishes-corrected-electron-passkeys-platform-packages) after a build issue, and [better-auth v1.6.21](/release/rel_ldLN9de2WwaFT56Kysczs-better-auth-v1-6-21-fixes-oauth-state-2fa-lockout-and-session-permission-changes) added a Zod v4 compatibility patch for device authorization alongside SSO URL validation hardening. [WorkOS's waitlist](/release/rel_xplBMAPtMJ_r-rwFcOFWX-workos-launches-waitlist-management-feature) rounds out a week where auth tooling focused less on flashy new primitives and more on making enterprise configuration something you can hand off to customers.","releaseIds":["rel_CgIkinC5LsRgHFxm6zfQ5","rel_IMY3v_DloK3wDl4dfensU","rel_TTGfsUBHeqQpLFWHZuWxn","rel_clfvMHC_Q2c-TbQVx3bSC","rel_RdjmDExD12i8WtwVVNMTp","rel_xplBMAPtMJ_r-rwFcOFWX","rel_wzlkEdnvJ_OqwNjco_OT1","rel_rLmOW5Eb65NNHpcPFpNqK","rel_ajozD1TPRH_g-vPLiLZV0","rel_jCQmWRmLoo3dNsIfKlAtk","rel__tuMtv1kqhlbxszvN_T44","rel_6BpnscciXJiiqdM0jdRT6","rel_SSd7YJSxztOaWeEDCRwri","rel_MGN0lgx3-YMJuftRJDEed","rel_ldLN9de2WwaFT56Kysczs"],"releaseCount":67,"generatedAt":"2026-07-11T17:05:52.601Z","releases":[{"id":"rel_CgIkinC5LsRgHFxm6zfQ5","title":"Clerk adds self-serve SSO for customer IT admins","path":"/release/rel_CgIkinC5LsRgHFxm6zfQ5-it-admins-configure-sso-from-security-tab-in-organizationprofile","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_IMY3v_DloK3wDl4dfensU","title":"@clerk/shared v4.22.0 handles expired organization domains in self-serve SSO","path":"/release/rel_IMY3v_DloK3wDl4dfensU-expired-org-domains-now-trigger-new-verification-in-sso-flow","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_TTGfsUBHeqQpLFWHZuWxn","title":"Clerk JavaScript SDK @clerk/ui@1.23.0 fixes SSO wizard state loss and adds drag-to-upload","path":"/release/rel_TTGfsUBHeqQpLFWHZuWxn-sso-wizard-no-longer-loses-place-on-data-refetch-drag-to-upload-added","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_clfvMHC_Q2c-TbQVx3bSC","title":"@clerk/eslint-plugin 0.2.0 changes glob matching to project root","path":"/release/rel_clfvMHC_Q2c-TbQVx3bSC-glob-patterns-now-match-project-root-instead-of-app","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_RdjmDExD12i8WtwVVNMTp","title":"WorkOS introduces multiple Projects and per-environment branding","path":"/release/rel_RdjmDExD12i8WtwVVNMTp-multiple-projects-per-org-per-environment-branding","org":{"slug":"workos","name":"WorkOS"},"importance":null},{"id":"rel_xplBMAPtMJ_r-rwFcOFWX","title":"WorkOS launches waitlist management feature","path":"/release/rel_xplBMAPtMJ_r-rwFcOFWX-waitlist-management-now-available","org":{"slug":"workos","name":"WorkOS"},"importance":null},{"id":"rel_wzlkEdnvJ_OqwNjco_OT1","title":"better-auth v1.7.0-rc.0 overhauls OAuth provider, renames MCP APIs, and adds back-channel logout","path":"/release/rel_wzlkEdnvJ_OqwNjco_OT1-oauth-provider-gets-back-channel-logout-mcp-apis-renamed-totp-otp-discriminated","org":{"slug":"better-auth","name":"Better Auth"},"importance":null},{"id":"rel_rLmOW5Eb65NNHpcPFpNqK","title":"Better Auth v1.7.0-beta.10 enforces rate limiting before plugins and revokes unproven credentials on magic link sign-in","path":"/release/rel_rLmOW5Eb65NNHpcPFpNqK-rate-limiting-runs-before-plugins-unproven-credentials-revoked-after-magic-link","org":{"slug":"better-auth","name":"Better Auth"},"importance":null},{"id":"rel_ajozD1TPRH_g-vPLiLZV0","title":"better-auth v1.6.22 fixes unproven credential revocation and wrong-org subscription actions","path":"/release/rel_ajozD1TPRH_g-vPLiLZV0-unproven-credentials-revoked-on-sign-in-scim-write-path-scoped","org":{"slug":"better-auth","name":"Better Auth"},"importance":null},{"id":"rel_jCQmWRmLoo3dNsIfKlAtk","title":"@clerk/clerk-js@6.22.0 prevents cross-tab broadcast from dropping session tokens","path":"/release/rel_jCQmWRmLoo3dNsIfKlAtk-cross-tab-broadcast-no-longer-discards-cached-tokens","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel__tuMtv1kqhlbxszvN_T44","title":"Clerk Expo v3.6.0 aligns iOS native module with Expo Modules, deprecates Google Sign-In","path":"/release/rel__tuMtv1kqhlbxszvN_T44-ios-native-module-aligned-to-expo-modules-google-sign-in-deprecation-announced","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_6BpnscciXJiiqdM0jdRT6","title":"Clerk Expo SDK v3.6.1 adds native theme colors for SSO buttons","path":"/release/rel_6BpnscciXJiiqdM0jdRT6-native-sso-buttons-support-secondary-color-theming","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_SSd7YJSxztOaWeEDCRwri","title":"Clerk iOS SDK 1.2.6 gates Apple sign-in by sign-up mode, adds native dev indicator","path":"/release/rel_SSd7YJSxztOaWeEDCRwri-apple-sign-in-gated-by-sign-up-mode-native-dev-indicator","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_MGN0lgx3-YMJuftRJDEed","title":"Clerk JavaScript SDK publishes corrected Electron passkeys platform packages","path":"/release/rel_MGN0lgx3-YMJuftRJDEed-corrected-electron-passkeys-platform-packages-published","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_ldLN9de2WwaFT56Kysczs","title":"better-auth v1.6.21 fixes OAuth state, 2FA lockout, and session permission changes","path":"/release/rel_ldLN9de2WwaFT56Kysczs-session-cache-bypass-fixed-oauth-state-rejection-hardened-2fa-lockout-after-5","org":{"slug":"better-auth","name":"Better Auth"},"importance":null}]}}