Better Auth restores schema stability while Clerk ships OAuth device verification everywhere

Better Auth restores the 1.6 schema

The biggest story this week is Better Auth's v1.7.3, and it's a case study in the cost of schema churn. The 1.7 line had introduced an issuer-based account schema that would have required existing users to run a backfill migration — a real cost for anyone already on 1.6. The team reversed course, restoring the original 1.6 account schema so existing installs upgrade without disruption. Users who already applied the 1.7 issuer schema get a documented cleanup path. The release also adds Cloudflare as a built-in social provider (with PKCE support and client-secret handling), enables schema validation by default at initialization so mismatches reject auth requests before they propagate, and adds an isPasswordCompromised check backed by Have I Been Pwned. Two quality fixes round it out: TOTP re-enrollment no longer overwrites active authenticators, and callback hooks are skipped correctly after proxied OAuth sign-ins. It's a release that matters as much for what it reverts as for what it ships.

Clerk's OAuth device verification lands across the SDK family

Nearly every Clerk SDK got the same new capability this week: an authenticated OAuth device verification component and workflow hook for approving or denying Device Authorization Grant requests. The rollout covers the core JavaScript SDK 6.31.0, Next.js 7.9.0, React 6.15.0, Vue 2.5.0, Nuxt 3.1.0, Astro 4.1.0, and the vanilla SDK at v4.16.0. If you're building for TVs, set-top boxes, or CLI-style OAuth flows, you now have a first-class UI path for that grant type instead of hand-rolling the polling loop. A day later, @clerk/ui 1.32.1 fixed a code-input overflow in the new component when the card isn't flush — hardly glamorous, but the component shipped in good shape.

Elsewhere, Clerk Expo 4.6.3 fixed a nasty Android bug where AuthView rendered a blank sign-in form if opened within seconds of isLoaded flipping true. A more consequential behavioral fix: Clerk JavaScript 6.30.3 now actually serializes oidcPrompt and oidcLoginHint in external account requests — they were accepted by the types but silently dropped, so providers like Google fell back to default prompt behavior. And the Expo SDK's Google sign-in now reports the stable account ID (the sub claim) as user.id instead of the email address, aligning Android with iOS behavior — worth knowing before you ship any code that keys users off that field.

The backend SDK tightened up too: @clerk/backend 3.17.0 now rejects JWT-template tokens presented as session tokens in the Authorization header, returning a signed-out state with a token-type-mismatch reason. Fastify gained an internal opt-out for the handshake flow for API-only backends that can't return Set-Cookie headers, and Next.js 7.8.4 added authoring-time deprecation warnings to the removed SignedIn/SignedOut/Protect stubs so editors flag the migration to <Show> before rendering.

Auth0 matures MFA and hands customers the controls

Auth0's notable shift this week is toward self-service. Advanced MFA Configurations went GA: remember-device lifetimes now span 1 hour to 90 days absolute instead of a fixed 30 days, OTP lengths for SMS and email run 4–10 digits, and OTP lifetimes are configurable. The My Organization API gained self-service configuration for cross-app access (XAA) and third-party application access, so org admins can manage those settings without routing every change through your team. The Dashboard navigation and IA refresh is in Early Access, an opt-in per-user redesign with a new sidebar and breadcrumbs — cosmetic, but a sign of where the product is heading. Elsewhere in the ecosystem, Supabase published several Auth release candidates with no user-facing changes documented, and Catch-all churn: Clerk iOS 1.5.3 added billing plan APIs and an AuthView completion callback.