Auth platforms split their week between MFA recovery, device flows, and enterprise traffic rules

Recovery codes and device flows arrive

The week's most substantial feature work landed on the identity providers themselves. Supabase Auth started building out MFA recovery codes — adding the crypto primitives, factor model, schema, and endpoints for generating, checking, verifying, regenerating, and deleting codes, alongside SCIM users and tokens tables, an expires_at column on one-time tokens, and metering events for OAuth server token exchange. Recovery codes are the safety net that keeps users from being permanently locked out when they lose their second factor, so this is the kind of feature that quietly removes a support burden for anyone running MFA in production.

Clerk took the opposite end of the device spectrum, shipping the OAuth 2.0 device authorization grant so CLI tools, TVs, and other input-constrained hardware can complete an authorization flow without a browser or keyboard. It follows the standard RFC 8628 shape and is in beta behind a contact request.

On the enterprise traffic side, Auth0 gave tenant administrators a blunt instrument: a Deny All rule for the Tenant ACL using a match_all: true attribute that ignores IP and geolocation signals entirely and rejects every request in scope. Assigned a high priority, it works as a fallback that closes the tenant off when nothing else matches. WorkOS, meanwhile, extended Feature Flags with custom targets, letting teams key rollouts on resources beyond users and organizations — workspaces, plans, environments, regions — which is the difference between a beta gated by account and a beta gated by the specific thing you actually want to test.

Clerk's SDK fleet catches up in one sweep

Clerk's JavaScript SDK did what large monorepos do: cut a coordinated batch of patches that mostly move every framework binding in lockstep. The standout behavioral fix is offline sign-out — when cached resources surface a network error, sign-out now completes locally, so users on a flaky connection can actually log out instead of staring at a spinner. Passkey autofill got a cleanup too: background requests that get rejected no longer surface RP ID or domain errors, and reverification hides "Use another method" when the current factor is the only one available.

The useSSO() hook gained oidcPrompt and oidcLoginHint parameters forwarded to the sign-in request, landing in @clerk/shared and the Expo SDK, where the bundled clerk-ios SDK also moved forward. Anyone doing enterprise SSO with prompt control should care about that one.

Two Android fixes are worth flagging for mobile teams: the Google Sign-In plugin and Expo passkeys both stopped failing on Android Gradle Plugin 9's "Cannot add extension with name 'kotlin'" error, which would have blocked builds outright for anyone who upgraded AGP.

The rest of the sweep is plumbing with a user-visible edge: dashboard links across the Express binding, the Next.js SDK, the Chrome Extension, and the upgrade tooling now point at the active-instance shortcut rather than the legacy last-active?path= URL, so error messages and READMEs send developers to the right environment. Framework bindings for Fastify, testing, localizations, Electron, React Router, Next.js, Astro, Vue, TanStack Start, Nuxt, React, and Hono all took dependency updates to keep pace.

Instrumentation gets a kill switch

Better Auth shipped a pair of releases whose headline feature is the same one twice: an option to disable OpenTelemetry span creation per auth instance landed on the stable line, and the same control arrived on the next minor as experimental.instrumentation.enabled, bundled with Vitest 5 support in the test utilities, additional session fields in testUtils helpers, and fixes for multibyte session data storage and stale sessions in Expo SecureStore. If you've been tracing every auth call whether you wanted to or not, that flag is the release you've been waiting for.