Clerk ships OAuth device flow everywhere, Better Auth restores its 1.6 schema, and Auth0 opens self-service XAA

Clerk takes OAuth device flow across the JavaScript stack

The headline of Clerk's week is a single feature shipped at once across its entire JavaScript surface: an authenticated component and workflow hook for approving or denying OAuth Device Authorization Grant requests. Rather than land in one package, it arrived simultaneously in the core JavaScript SDK, React, Next.js, Vue, Nuxt, Astro, and the framework-agnostic package, with the umbrella SDK release tying it together. If you build CLI tools or TV apps on Clerk, that flow now has first-party UI. A follow-up patch to the UI package fixed the verification code input overflowing its card.

The same minor release cycle fixed a quieter but more annoying bug: configured OIDC prompts were being ignored by sign-up continuations — enterprise SSO after email-link verification, direct combined-flow transfers, and OAuth sign-ups embedded in <SignIn withSignUp> — and now those prompts are honored. Relatedly, oidcPrompt and oidcLoginHint were silently dropped from Frontend API requests in createExternalAccount() and reauthorize() despite being in the public types; they are now serialized correctly so Google and friends stop falling back to default prompt behavior.

Elsewhere in the stack: the Expo SDK now reports Google's stable account identifier on Android instead of the email address, matching iOS — worth noting for anyone keying users off user.id. Expo also fixed a blank Android sign-in form that appeared when AuthView opened moments after isLoaded flipped, and kept post-auth prompts open across iOS SDK config refreshes. The backend rejected JWT-template tokens presented as session tokens and added experimental transactional email methods, Fastify gained an opt-out for the handshake flow aimed at API-only backends that can't set cookies, and Next.js deprecated its removed control-component stubs so editors flag them at authoring time. The remaining two dozen or so releases were dependency propagation, with one exception: Astro bumped nanoid for an upstream security fix.

Better Auth backs out the 1.7 issuer schema

Better Auth's release this week is largely an apology tour: the 1.6 account schema is restored to avoid forcing a disruptive backfill on existing users, with a cleanup guide for anyone who already applied the 1.7 issuer schema. The rest of the release is substantive — Cloudflare arrives as a built-in social provider with client secret and PKCE support, schema validation runs by default at initialization and rejects requests on mismatches, and a new isPasswordCompromised check queries Have I Been Pwned. It also fixes TOTP re-enrollment clobbering active authenticators and duplicate session requests in Nuxt.

Auth0 hands configuration to organization admins

Auth0's most consequential change is self-service third-party application access and Cross App Access configuration through the My Organization API and Embeddable UI Components, in Open Early Access — organization admins can now grant resource application roles with guardrails you define, instead of routing every change through your team. Alongside it, Advanced MFA Configurations reached general availability, turning fixed values into policy: remember-device windows now span 1 hour to 90 days absolute, and SMS and email OTP lengths are configurable from 4 to 10 digits. A Dashboard navigation and IA refresh also entered Early Access as a per-user opt-in.

Around the collection

Clerk's iOS SDK added billing plan, subscription, and credit APIs plus authorization checks for roles, features, and plans, and gave AuthView a completion callback so callers know when the flow ends. Supabase Auth continued its v2.197.0 release-candidate cadence with checksum-only builds, including the rc.12 candidate and rc.36, with no user-facing notes.