{"collection":{"slug":"auth-identity","name":"Auth & Identity"},"digest":{"id":"cwd_rxu41M1j0TYx17MWmHk5H","weekStart":"2026-07-20","title":"Better Auth overhauls account identity, Clerk cuts Astro middleware","intro":"Better Auth shipped a breaking 1.7.0 release candidate that renames account fields and moves join configuration, while Clerk's Astro v4.0.0 removes middleware-based route matching and drops Astro 4 support. Both platforms also shipped critical fixes for OAuth flows, session caching, and identity synchronization.","body":"### Better Auth's breaking reorg and Apple PKCE fix\n\nThe headline story this week is [Better Auth's v1.7.0-rc.2](/release/rel_JrZYJeA_pju92QHhpXGGl-better-auth-v1-7-0-rc-2-overhauls-account-identity-moves-joins-config-and), a release candidate that touches three core areas. The `Account.accountId` field is renamed to `Account.providerAccountId` — a semantic improvement that aligns the schema with OAuth terminology. The experimental `joins` config moves from `experimental.joins` to `advanced.database.joins`, requiring a one-line config change for anyone using native join support. And SCIM is now decoupled from the organization plugin, meaning existing SCIM directories must be fully reprovisioned after upgrading. For teams running on the `v1.6.x` line, a [v1.6.25 patch](/release/rel_v0SvdqvJ5ggVF5IZwXr2u-better-auth-v1-6-25-fixes-apple-oauth-pkce-failure-and-google-one-tap-sign-up) fixes two important OAuth bugs: Apple OAuth was failing to send the PKCE code challenge, causing token exchange failures, and Google One Tap was creating new users even when sign-up was disabled on the provider. A separate [v1.6.24 patch](/release/rel_NP8kwi7NpL4ugN05VCLQ0-better-auth-v1-6-24-fixes-stale-session-cache-oauth-cookie-drop-and-cold-start) addresses a wider set of issues including stale session caching (the get-session endpoint now sends `no-store` cache headers), a cookie drop during Electron OAuth handoff, and a race condition in AsyncLocalStorage on serverless cold starts. It also hardens security by validating the `Origin` header on magic-link and email-OTP endpoints for cookieless requests.\n\n### Clerk: Astro majors, iOS atomicity, and MCP ease\n\n[Clerk's `@clerk/astro` v4.0.0](/release/rel_AtPhrqUqdrnA294KfcLD0-clerk-astro-v4-0-0-adds-astro-7-support-drops-astro-4-removes-createroutematcher) is a major release that adds Astro 7 support and drops Astro 4 entirely. The bigger behavioral change is the removal of `createRouteMatcher` from `@clerk/astro/server` — auth checks must now be placed in each page, API route, or server handler rather than relying on middleware-based path matching. A follow-up [v4.0.1 patch](/release/rel_7dsMGW3yp_VxsXyuQgGno-clerk-javascript-sdk-clerk-astro-4-0-1-fixes-clerkmiddleware-request-body) fixes a bug where `clerkMiddleware()` was consuming the request body, preventing downstream handlers from reading it. On the iOS side, [Clerk iOS SDK 1.3.3](/release/rel_4c0u7G8-Q0LmReFo6dSso-clerk-ios-sdk-1-3-3-adds-atomic-identity-sync-and-fixes-sign-up-race) adds atomic identity sync to prevent state corruption across shared sessions and fixes a startup sign-up race condition. The [Expo SDK v4.0.3](/release/rel_k7vfIAILBjIqgLEg6AQ6y-clerk-expo-v4-0-3-prevents-stale-client-replacement-on-signed-in-sessions) extends similar protection to native clients, preventing stale or sessionless clients from replacing signed-in ones. And [Expo v4.0.1](/release/rel_NhWs1yhvHjxPaynzBmlgg-clerk-expo-v4-0-1-fixes-usesigninwithapple-dropping-user-names-on-native-sign-up) fixes `useSignInWithApple` dropping the user's first and last name on native sign-up — the hook now signs up with the Apple credential name and falls back to sign-in when the account already exists.\n\nFor developer experience, the new [Clerk MCP server](/release/rel_ayc9mIxKu0A3iByIn5zQU-clerk-mcp-server-installs-across-ai-clients-with-one-command) can install itself across ten AI clients including Claude Code and Cursor with a single `clerk mcp install` command. Meanwhile, Clerk's configurable default OAuth scopes for dynamic client registration help resolve `invalid_scope` errors when clients like ChatGPT omit the scope parameter — you can set defaults in the Dashboard or via the Backend API.\n\n### Auth0 and Supabase: SSO delegation and token hygiene\n\n[Auth0](/release/rel_PwKCaA74tRXyqgADYt0jf-auth0-lets-customer-admins-decide-third-party-sso-app-access-during-self-service) now lets you delegate the third-party application access decision to customer admins during self-service SSO setup — when generating a Self-Service Enterprise Configuration ticket, you can add a step where the customer admin chooses whether to allow third-party apps to use their connection. [Supabase Auth v2.193.1](/release/rel_8qQeAMjPIqMqAZFpTXxWV-supabase-auth-v2-193-1-revokes-legacy-refresh-tokens-and-fixes-oauth-replay-race) revokes legacy refresh tokens on rotation and prevents an OAuth authorization-code replay race at the `/oauth/token` endpoint, plus fixes a panic on malformed SIWE signatures.\n\n### Around the periphery\n\nClerk shipped a [Next.js v7.6.0](/release/rel_eVDFWc77YJKFA6ZKQVcrV-clerk-next-js-sdk-v7-6-0-adds-custom-frontend-api-url-option) minor that adds a `fapiUrl` option for custom Frontend API URLs, and [UI v1.26.0](/release/rel_-JhhPwGQVuGLpUZPBAlyN-clerk-ui-v1-26-0-exposes-composable-profile-subcomponents) exposes composable `UserProfile` and `OrganizationProfile` subcomponents from `@clerk/ui/experimental`. A dependency update wave swept through nearly two dozen Clerk packages on Friday, all bumping `@clerk/shared` to v4.25.8 with no functional changes, and a smaller mid-week wave updated the same packages to v4.25.7 — standard housekeeping that we mention only to note that it happened.","releaseIds":["rel_JrZYJeA_pju92QHhpXGGl","rel_v0SvdqvJ5ggVF5IZwXr2u","rel_NP8kwi7NpL4ugN05VCLQ0","rel_AtPhrqUqdrnA294KfcLD0","rel_7dsMGW3yp_VxsXyuQgGno","rel_4c0u7G8-Q0LmReFo6dSso","rel_k7vfIAILBjIqgLEg6AQ6y","rel_NhWs1yhvHjxPaynzBmlgg","rel_ayc9mIxKu0A3iByIn5zQU","rel_PwKCaA74tRXyqgADYt0jf","rel_8qQeAMjPIqMqAZFpTXxWV","rel_eVDFWc77YJKFA6ZKQVcrV","rel_-JhhPwGQVuGLpUZPBAlyN"],"releaseCount":77,"generatedAt":"2026-07-27T06:17:14.762Z","releases":[{"id":"rel_JrZYJeA_pju92QHhpXGGl","title":"Better Auth v1.7.0-rc.2 overhauls account identity, moves joins config, and decouples SCIM","path":"/release/rel_JrZYJeA_pju92QHhpXGGl-account-identity-scoped-by-issuer-scim-standalone-joins-config-moved","org":{"slug":"better-auth","name":"Better Auth"},"importance":4},{"id":"rel_v0SvdqvJ5ggVF5IZwXr2u","title":"better-auth v1.6.25 fixes Apple OAuth PKCE failure and Google One Tap sign-up bypass","path":"/release/rel_v0SvdqvJ5ggVF5IZwXr2u-apple-oauth-pkce-fix-google-one-tap-respects-sign-up-disabled","org":{"slug":"better-auth","name":"Better Auth"},"importance":3},{"id":"rel_NP8kwi7NpL4ugN05VCLQ0","title":"better-auth v1.6.24 fixes stale session cache, OAuth cookie drop, and cold-start race","path":"/release/rel_NP8kwi7NpL4ugN05VCLQ0-stale-session-cache-fixed-oauth-cookie-hardfened-cold-start-race-resolved","org":{"slug":"better-auth","name":"Better Auth"},"importance":2},{"id":"rel_AtPhrqUqdrnA294KfcLD0","title":"@clerk/astro v4.0.0 adds Astro 7 support, drops Astro 4, removes createRouteMatcher","path":"/release/rel_AtPhrqUqdrnA294KfcLD0-astro-7-supported-astro-4-and-createroutematcher-removed","org":{"slug":"clerk","name":"Clerk"},"importance":4},{"id":"rel_7dsMGW3yp_VxsXyuQgGno","title":"Clerk JavaScript SDK @clerk/astro@4.0.1 fixes clerkMiddleware() request body consumption","path":"/release/rel_7dsMGW3yp_VxsXyuQgGno-clerkmiddleware-no-longer-consumes-request-body","org":{"slug":"clerk","name":"Clerk"},"importance":2},{"id":"rel_4c0u7G8-Q0LmReFo6dSso","title":"Clerk iOS SDK 1.3.3 adds atomic identity sync and fixes sign-up race","path":"/release/rel_4c0u7G8-Q0LmReFo6dSso-atomic-identity-sync-for-shared-sessions-sign-up-race-fixed","org":{"slug":"clerk","name":"Clerk"},"importance":2},{"id":"rel_k7vfIAILBjIqgLEg6AQ6y","title":"Clerk Expo v4.0.3 prevents stale client replacement on signed-in sessions","path":"/release/rel_k7vfIAILBjIqgLEg6AQ6y-native-client-updates-no-longer-replace-signed-in-sessions","org":{"slug":"clerk","name":"Clerk"},"importance":3},{"id":"rel_NhWs1yhvHjxPaynzBmlgg","title":"Clerk Expo v4.0.1 fixes useSignInWithApple dropping user names on native sign-up","path":"/release/rel_NhWs1yhvHjxPaynzBmlgg-usesigninwithapple-no-longer-drops-user-s-first-and-last-name","org":{"slug":"clerk","name":"Clerk"},"importance":3},{"id":"rel_ayc9mIxKu0A3iByIn5zQU","title":"Clerk MCP server installs across AI clients with one command","path":"/release/rel_ayc9mIxKu0A3iByIn5zQU-clerk-mcp-installs-in-ten-ai-clients-with-one-command","org":{"slug":"clerk","name":"Clerk"},"importance":3},{"id":"rel_PwKCaA74tRXyqgADYt0jf","title":"Auth0 lets customer admins decide third-party SSO app access during self-service setup","path":"/release/rel_PwKCaA74tRXyqgADYt0jf-customer-admins-can-now-choose-third-party-app-access-during-sso-setup","org":{"slug":"auth0","name":"Auth0"},"importance":3},{"id":"rel_8qQeAMjPIqMqAZFpTXxWV","title":"Supabase Auth v2.193.1 revokes legacy refresh tokens and fixes OAuth replay race","path":"/release/rel_8qQeAMjPIqMqAZFpTXxWV-legacy-refresh-tokens-revoked-oauth-replay-race-fixed","org":{"slug":"supabase","name":"Supabase"},"importance":3},{"id":"rel_eVDFWc77YJKFA6ZKQVcrV","title":"Clerk Next.js SDK v7.6.0 adds custom Frontend API URL option","path":"/release/rel_eVDFWc77YJKFA6ZKQVcrV-frontend-api-proxy-helpers-target-custom-urls","org":{"slug":"clerk","name":"Clerk"},"importance":2},{"id":"rel_-JhhPwGQVuGLpUZPBAlyN","title":"Clerk UI v1.26.0 exposes composable profile subcomponents","path":"/release/rel_-JhhPwGQVuGLpUZPBAlyN-composable-userprofile-and-organizationprofile-subcomponents-exposed","org":{"slug":"clerk","name":"Clerk"},"importance":2}]}}