Better Auth overhauls account identity, Clerk cuts Astro middleware

Better Auth's breaking reorg and Apple PKCE fix

The headline story this week is Better Auth's v1.7.0-rc.2, a release candidate that touches three core areas. The Account.accountId field is renamed to Account.providerAccountId — a semantic improvement that aligns the schema with OAuth terminology. The experimental joins config moves from experimental.joins to advanced.database.joins, requiring a one-line config change for anyone using native join support. And SCIM is now decoupled from the organization plugin, meaning existing SCIM directories must be fully reprovisioned after upgrading. For teams running on the v1.6.x line, a v1.6.25 patch fixes two important OAuth bugs: Apple OAuth was failing to send the PKCE code challenge, causing token exchange failures, and Google One Tap was creating new users even when sign-up was disabled on the provider. A separate v1.6.24 patch addresses a wider set of issues including stale session caching (the get-session endpoint now sends no-store cache headers), a cookie drop during Electron OAuth handoff, and a race condition in AsyncLocalStorage on serverless cold starts. It also hardens security by validating the Origin header on magic-link and email-OTP endpoints for cookieless requests.

Clerk: Astro majors, iOS atomicity, and MCP ease

Clerk's @clerk/astro v4.0.0 is a major release that adds Astro 7 support and drops Astro 4 entirely. The bigger behavioral change is the removal of createRouteMatcher from @clerk/astro/server — auth checks must now be placed in each page, API route, or server handler rather than relying on middleware-based path matching. A follow-up v4.0.1 patch fixes a bug where clerkMiddleware() was consuming the request body, preventing downstream handlers from reading it. On the iOS side, Clerk iOS SDK 1.3.3 adds atomic identity sync to prevent state corruption across shared sessions and fixes a startup sign-up race condition. The Expo SDK v4.0.3 extends similar protection to native clients, preventing stale or sessionless clients from replacing signed-in ones. And Expo v4.0.1 fixes useSignInWithApple dropping the user's first and last name on native sign-up — the hook now signs up with the Apple credential name and falls back to sign-in when the account already exists.

For developer experience, the new Clerk MCP server can install itself across ten AI clients including Claude Code and Cursor with a single clerk mcp install command. Meanwhile, Clerk's configurable default OAuth scopes for dynamic client registration help resolve invalid_scope errors when clients like ChatGPT omit the scope parameter — you can set defaults in the Dashboard or via the Backend API.

Auth0 and Supabase: SSO delegation and token hygiene

Auth0 now lets you delegate the third-party application access decision to customer admins during self-service SSO setup — when generating a Self-Service Enterprise Configuration ticket, you can add a step where the customer admin chooses whether to allow third-party apps to use their connection. Supabase Auth v2.193.1 revokes legacy refresh tokens on rotation and prevents an OAuth authorization-code replay race at the /oauth/token endpoint, plus fixes a panic on malformed SIWE signatures.

Around the periphery

Clerk shipped a Next.js v7.6.0 minor that adds a fapiUrl option for custom Frontend API URLs, and UI v1.26.0 exposes composable UserProfile and OrganizationProfile subcomponents from @clerk/ui/experimental. A dependency update wave swept through nearly two dozen Clerk packages on Friday, all bumping @clerk/shared to v4.25.8 with no functional changes, and a smaller mid-week wave updated the same packages to v4.25.7 — standard housekeeping that we mention only to note that it happened.