--- collection: auth-identity collection_name: Auth & Identity week_start: 2026-08-31 title: Better Auth restores schema stability while Clerk ships OAuth device verification everywhere release_count: 65 generated: 2026-09-07 canonical: https://releases.sh/collections/auth-identity/digest/2026-08-31 --- # Better Auth restores schema stability while Clerk ships OAuth device verification everywhere Better Auth v1.7.3 walks back a disruptive schema change that forced an issuer-account backfill, and Clerk began rolling out an OAuth Device Authorization Grant approval flow across its entire SDK family. Auth0 also made advanced MFA configurations generally available this week. ### Better Auth restores the 1.6 schema The biggest story this week is [Better Auth's v1.7.3](/release/rel_aVSsGmCHa9bxJCk8BoHht-better-auth-v1-7-3-restores-1-6-account-schema-and-adds-cloudflare-provider), and it's a case study in the cost of schema churn. The 1.7 line had introduced an issuer-based account schema that would have required existing users to run a backfill migration — a real cost for anyone already on 1.6. The team reversed course, restoring the original 1.6 account schema so existing installs upgrade without disruption. Users who already applied the 1.7 issuer schema get a documented cleanup path. The release also adds Cloudflare as a built-in social provider (with PKCE support and client-secret handling), enables schema validation by default at initialization so mismatches reject auth requests before they propagate, and adds an `isPasswordCompromised` check backed by Have I Been Pwned. Two quality fixes round it out: TOTP re-enrollment no longer overwrites active authenticators, and callback hooks are skipped correctly after proxied OAuth sign-ins. It's a release that matters as much for what it reverts as for what it ships. ### Clerk's OAuth device verification lands across the SDK family Nearly every Clerk SDK got the same new capability this week: an authenticated OAuth device verification component and workflow hook for approving or denying Device Authorization Grant requests. The rollout covers the core [JavaScript SDK 6.31.0](/release/rel_XMKkNR--EB-_4KS3fqjKA-clerk-javascript-sdk-6-31-0-adds-oauth-device-verification-component), [Next.js 7.9.0](/release/rel_dJrdRjAw6F80I_dgUdiOc-clerk-next-js-sdk-7-9-0-adds-oauth-device-verification-component-and-hook), [React 6.15.0](/release/rel_r9NFXVKIRcasKWJ4Qke9U-clerk-react-6-15-0-adds-oauth-device-verification-workflow), [Vue 2.5.0](/release/rel_bSjkpOT-S869o7x0pNchJ-clerk-vue-sdk-2-5-0-adds-oauth-device-verification-component-and-hook), [Nuxt 3.1.0](/release/rel_uffH7jGsAB5R1Y7BTeYUd-clerk-nuxt-sdk-v3-1-0-adds-oauth-device-verification-component), [Astro 4.1.0](/release/rel_21qeBf1BcdwP-0tlqCph8-clerk-astro-sdk-v4-1-0-adds-oauth-device-verification-workflow), and the [vanilla SDK at v4.16.0](/release/rel_bnp0WDioeooamcwyiYVlF-clerk-javascript-sdk-v4-16-0-adds-oauth-device-authorization-component). If you're building for TVs, set-top boxes, or CLI-style OAuth flows, you now have a first-class UI path for that grant type instead of hand-rolling the polling loop. A day later, [@clerk/ui 1.32.1](/release/rel_hrhUZLpQLZV5U7M5wCoOB-javascript-sdk-clerk-ui-1-32-1-fixes-oauthdeviceverification-code-input-overflow) fixed a code-input overflow in the new component when the card isn't flush — hardly glamorous, but the component shipped in good shape. Elsewhere, [Clerk Expo 4.6.3](/release/rel_nafGHxNV7WgLZw2g9JMj6-clerk-expo-4-6-3-fixes-blank-android-sign-in-form-on-startup) fixed a nasty Android bug where AuthView rendered a blank sign-in form if opened within seconds of `isLoaded` flipping true. A more consequential behavioral fix: [Clerk JavaScript 6.30.3](/release/rel_Kcq_mW6NwRxygINorhApT-clerk-javascript-6-30-3-sends-oidcprompt-and-oidcloginhint-in-external-account) now actually serializes `oidcPrompt` and `oidcLoginHint` in external account requests — they were accepted by the types but silently dropped, so providers like Google fell back to default prompt behavior. And [the Expo SDK's Google sign-in](/release/rel_CmGVBAfMzHsSMsIVkcFrx-clerk-expo-google-sign-in-matches-ios-by-using-stable-account-id) now reports the stable account ID (the `sub` claim) as `user.id` instead of the email address, aligning Android with iOS behavior — worth knowing before you ship any code that keys users off that field. The backend SDK tightened up too: [@clerk/backend 3.17.0](/release/rel_gVHEellaBx_TPApv526_f-clerk-javascript-sdk-3-17-0-adds-internal-transactional-email-methods) now rejects JWT-template tokens presented as session tokens in the Authorization header, returning a signed-out state with a `token-type-mismatch` reason. [Fastify](/release/rel_sBZ_alAdxjXDdwVn1aAy6-clerk-fastify-sdk-adds-handshake-opt-out-for-api-only-backends) gained an internal opt-out for the handshake flow for API-only backends that can't return Set-Cookie headers, and [Next.js 7.8.4](/release/rel_A_q-8TgNoLcodA5rAJyM0-clerk-next-js-sdk-7-8-4-deprecates-control-component-stubs-at-authoring-time) added authoring-time deprecation warnings to the removed SignedIn/SignedOut/Protect stubs so editors flag the migration to `` before rendering. ### Auth0 matures MFA and hands customers the controls Auth0's notable shift this week is toward self-service. [Advanced MFA Configurations went GA](/release/rel_75RcrUcyYlcE1ylF1J7Eh-auth0-makes-advanced-mfa-configurations-generally-available): remember-device lifetimes now span 1 hour to 90 days absolute instead of a fixed 30 days, OTP lengths for SMS and email run 4–10 digits, and OTP lifetimes are configurable. The [My Organization API](/release/rel_zTEErD_VP4QPXblrEKxBL-auth0-my-organization-api-adds-self-service-xaa-and-third-party-app) gained self-service configuration for cross-app access (XAA) and third-party application access, so org admins can manage those settings without routing every change through your team. The [Dashboard navigation and IA refresh](/release/rel_eej7h0_MRisHUZ3Yu5F2Z-auth0-dashboard-navigation-and-ia-refresh-now-in-early-access) is in Early Access, an opt-in per-user redesign with a new sidebar and breadcrumbs — cosmetic, but a sign of where the product is heading. Elsewhere in the ecosystem, [Supabase published several Auth release candidates](/release/rel_tcYQ7G2fsd-7DxdcVEOcA-supabase-auth-v2-197-0-rc-12-release-candidate-published) with no user-facing changes documented, and Catch-all churn: [Clerk iOS 1.5.3](/release/rel_wY7Y7xtVF0bydWDtD9SBv-clerk-ios-sdk-1-5-3-adds-billing-plan-and-subscription-apis) added billing plan APIs and an AuthView completion callback. ## Releases covered ### Auth0 - [Auth0 makes Advanced MFA Configurations generally available](https://releases.sh/release/rel_75RcrUcyYlcE1ylF1J7Eh-advanced-mfa-configurations-now-ga) - [Auth0 My Organization API adds self-service XAA and third-party app configuration](https://releases.sh/release/rel_zTEErD_VP4QPXblrEKxBL-organization-admins-can-now-self-configure-xaa-and-third-party-app-access) - [Auth0 Dashboard navigation and IA refresh now in Early Access](https://releases.sh/release/rel_eej7h0_MRisHUZ3Yu5F2Z-dashboard-navigation-ia-refresh-in-early-access) ### Better Auth - [Better Auth v1.7.3 restores 1.6 account schema and adds Cloudflare provider](https://releases.sh/release/rel_aVSsGmCHa9bxJCk8BoHht-1-6-account-schema-restored-cloudflare-provider-added) ### Clerk - [Clerk JavaScript SDK 6.31.0 adds OAuth device verification component](https://releases.sh/release/rel_XMKkNR--EB-_4KS3fqjKA-oauth-device-verification-component-and-hook-added) - [Clerk Next.js SDK 7.9.0 adds OAuth device verification component and hook](https://releases.sh/release/rel_dJrdRjAw6F80I_dgUdiOc-oauth-device-verification-component-and-workflow-hook-added) - [Clerk React 6.15.0 adds OAuth device verification workflow](https://releases.sh/release/rel_r9NFXVKIRcasKWJ4Qke9U-oauth-device-authorization-approvals-added) - [Clerk Vue SDK 2.5.0 adds OAuth device verification component and hook](https://releases.sh/release/rel_bSjkpOT-S869o7x0pNchJ-oauth-device-approval-workflow-component-added) - [Clerk Nuxt SDK v3.1.0 adds OAuth device verification component](https://releases.sh/release/rel_uffH7jGsAB5R1Y7BTeYUd-oauth-device-verification-component-added) - [Clerk Astro SDK v4.1.0 adds OAuth device verification workflow](https://releases.sh/release/rel_21qeBf1BcdwP-0tlqCph8-oauth-device-verification-component-added-to-clerk-astro) - [Clerk JavaScript SDK v4.16.0 adds OAuth device authorization component](https://releases.sh/release/rel_bnp0WDioeooamcwyiYVlF-oauth-device-approval-component-and-hook-added) - [JavaScript SDK @clerk/ui@1.32.1 fixes OAuthDeviceVerification code input overflow](https://releases.sh/release/rel_hrhUZLpQLZV5U7M5wCoOB-oauthdeviceverification-code-input-no-longer-overflows-card) - [Clerk Expo 4.6.3 fixes blank Android sign-in form on startup](https://releases.sh/release/rel_nafGHxNV7WgLZw2g9JMj6-android-authview-no-longer-stays-blank-on-startup) - [Clerk JavaScript 6.30.3 sends oidcPrompt and oidcLoginHint in external account requests](https://releases.sh/release/rel_Kcq_mW6NwRxygINorhApT-oidcprompt-and-oidcloginhint-now-sent-in-external-account-requests) - [Clerk Expo Google Sign-in matches iOS by using stable account ID](https://releases.sh/release/rel_CmGVBAfMzHsSMsIVkcFrx-android-now-reports-stable-user-id-like-ios) - [Clerk JavaScript SDK @3.17.0 adds internal transactional email methods](https://releases.sh/release/rel_gVHEellaBx_TPApv526_f-transactional-email-methods-added-jwt-session-token-mismatch-rejected) - [Clerk Fastify SDK adds handshake opt-out for API-only backends](https://releases.sh/release/rel_sBZ_alAdxjXDdwVn1aAy6-handshake-flow-now-skippable-for-api-only-backends) - [Clerk Next.js SDK 7.8.4 deprecates control-component stubs at authoring time](https://releases.sh/release/rel_A_q-8TgNoLcodA5rAJyM0-control-component-stubs-now-deprecated-at-authoring-time) - [Clerk iOS SDK 1.5.3 adds billing plan and subscription APIs](https://releases.sh/release/rel_wY7Y7xtVF0bydWDtD9SBv-billing-get-apis-and-authorization-checks-added) ### Supabase - [Supabase Auth v2.197.0-rc.12 release candidate published](https://releases.sh/release/rel_tcYQ7G2fsd-7DxdcVEOcA-release-candidate-v2-197-0-rc-12-published)