{"collection":{"slug":"auth-identity","name":"Auth & Identity"},"digest":{"id":"cwd_O0PWp20WQ5FVJxZYG00JI","weekStart":"2026-09-07","title":"Clerk's Expo toolchain gets a build fix as MFA recovery codes land in Supabase Auth","intro":"Supabase Auth shipped MFA recovery codes with matching crypto primitives and endpoints, while Clerk's SDK lineup fixed Android Gradle Plugin 9 build failures, added OIDC prompt hints to useSSO, and completed offline sign-out.","body":"### Recovery paths for locked-out users\n\nThe week's most substantial single feature landed in [Supabase Auth's v2.197.0](/release/rel_IWYTO7y9-JR3cgUUHkIk3-supabase-auth-adds-mfa-recovery-codes-scim-tables-in-v2-197-0), which introduces MFA recovery codes end to end: crypto primitives, factor model support, schema changes, and the full set of generate, status, verify, regenerate, and delete endpoints. Recovery codes are the unglamorous half of any MFA rollout — without them, a lost authenticator app means a support ticket and a manual account reset — so having first-party generation and verification inside the auth server removes a chunk of custom code that teams would otherwise maintain themselves. The same release also lays groundwork for enterprise provisioning with SCIM users and tokens tables, adds an `expires_at` column to one_time_tokens, and introduces OAuth server token exchange metering events. Support for [Clerk's OAuth 2.0 device authorization grant](/release/rel_YaJ788vFomZ4O-dAlhdLF-clerk-adds-oauth-device-authorization-grant-flow) rounds out the theme of reaching users and devices that standard browser redirects can't cover; the RFC 8628 flow is in beta and aimed at CLIs, TVs, and other input-constrained hardware. On the access-control side, [Auth0's Deny All rule for Tenant ACL](/release/rel_DvmDMEoNTrg5dp0svKKyc-auth0-adds-deny-all-rule-for-tenant-acl-to-reject-all-traffic) gives operators a `match_all: true` fallback that rejects all traffic to a scope regardless of IP or geolocation signals — a useful safety net when a tenant needs to be closed off immediately.\n\n### A rough patch for Expo and Android builds\n\nClerk's busiest work this week was unblocking mobile builds. Android Gradle Plugin 9 broke compilation with a `Cannot add extension with name 'kotlin'` error, and the fix landed in both [@clerk/expo-google-signin v1.0.4](/release/rel_Mqb1xyggst-RH9g3WN_gq-clerk-expo-google-signin-v1-0-4-fixes-android-gradle-plugin-9-build-failure) and [@clerk/expo-passkeys v2.0.18](/release/rel_XX6TSPLfxIPmdNqHbsBhw-clerk-expo-passkeys-v2-0-18-fixes-android-gradle-plugin-9-build-failure) — if your Android build started failing after an AGP upgrade, these are the patches to pull. The [Clerk Expo SDK v4.6.6](/release/rel_xbSO6pQgmlaVBJv2L67f0-clerk-expo-sdk-v4-6-6-adds-oidc-prompt-parameters-to-usesso) went further, teaching `useSSO()` to accept `oidcPrompt` and `oidcLoginHint` parameters and forward them to the sign-in request, which matters when you need to force a fresh consent screen or pre-fill an email for enterprise SSO. The same parameter support arrived in [@clerk/shared 4.31.1](/release/rel_fGngYr0Nb2hf1MhznoiI2-clerk-javascript-sdk-clerk-shared-4-31-1-adds-oidc-prompt-and-login-hint-to), so the hook behaves consistently across frameworks. Elsewhere in the SDK, [Clerk v6.31.1](/release/rel_UCuqc9c3wNeA8xgePDKnG-clerk-javascript-sdk-v6-31-1-completes-offline-sign-out-and-updates-dependencies) completed local sign-out while offline, letting users log out even when cached resources return a network error — a small change with real consequences for installed and flaky-network environments.\n\n### Instrumentation, UI polish, and documentation cleanup\n\n[Better Auth v1.7.4](/release/rel_p1xk-lVM10YsGxlqhrMFc-better-auth-v1-7-4-adds-opentelemetry-disable-flag-vitest-5-support-and-expo) added `experimental.instrumentation.enabled` to turn off OpenTelemetry span creation per auth instance, plus Vitest 5 support in the test utilities and fixes for multibyte session data and stale sessions in Expo SecureStore. The OpenTelemetry toggle also shipped to the 1.6 line as [better-auth v1.6.31](/release/rel_Uz-oDyTnsiT5OdOqMvYWU-better-auth-v1-6-31-adds-option-to-disable-opentelemetry-span-creation), so teams on the older branch aren't forced to upgrade for it. User-facing polish came from [@clerk/ui v1.32.3](/release/rel_Uh8y1ZpoiF-y-KkXDwQvD-clerk-ui-v1-32-3-updates-dashboard-links-and-fixes-passkey-autofill-errors), which stopped passkey autofill from surfacing RP ID or domain errors on rejected background requests and hid the \"Use another method\" option during reverification when the current factor is the only one available.\n\nMost of the remaining Clerk output this week was routine: a broad sweep replacing legacy `/last-active?path=…` URLs with the `https://dashboard.clerk.com/~/…` active-instance shortcut across [@clerk/express](/release/rel_jFkqo4mANXdUNQpxWfa-j-clerk-express-v2-1-67-updates-dashboard-links-to-active-instance-shortcut), [Clerk v3.17.2](/release/rel_N8o0NTlG_maSsrZm7NFtU-clerk-javascript-sdk-v3-17-2-updates-dashboard-links-to-active-instance-shortcut), [@clerk/upgrade 2.0.6](/release/rel_qGNvHfC3GA7lpKfqn3fTv-clerk-upgrade-2-0-6-updates-dashboard-links-to-active-instance-shortcut), and the [Chrome Extension](/release/rel_JN8nIjmWNEpGfcCwiluAj-clerk-chrome-extension-v3-1-82-updates-dashboard-links-to-active-instance), alongside dependency-only bumps for the Next.js, React, Vue, Nuxt, Astro, Hono, TanStack, React Router, Electron, testing, and localizations packages. Meanwhile WorkOS added [custom targeting for Feature Flags](/release/rel_pCIK3rEgItrSaUcpHf6Vp-feature-flags-custom-targeting), letting rollouts key off resources like workspaces, plans, environments, or regions rather than just users and organizations.","releaseIds":["rel_IWYTO7y9-JR3cgUUHkIk3","rel_YaJ788vFomZ4O-dAlhdLF","rel_DvmDMEoNTrg5dp0svKKyc","rel_Mqb1xyggst-RH9g3WN_gq","rel_XX6TSPLfxIPmdNqHbsBhw","rel_xbSO6pQgmlaVBJv2L67f0","rel_fGngYr0Nb2hf1MhznoiI2","rel_UCuqc9c3wNeA8xgePDKnG","rel_p1xk-lVM10YsGxlqhrMFc","rel_Uz-oDyTnsiT5OdOqMvYWU","rel_Uh8y1ZpoiF-y-KkXDwQvD","rel_jFkqo4mANXdUNQpxWfa-j","rel_N8o0NTlG_maSsrZm7NFtU","rel_qGNvHfC3GA7lpKfqn3fTv","rel_JN8nIjmWNEpGfcCwiluAj","rel_pCIK3rEgItrSaUcpHf6Vp"],"releaseCount":28,"generatedAt":"2026-09-14T06:21:58.855Z","releases":[{"id":"rel_IWYTO7y9-JR3cgUUHkIk3","title":"Supabase Auth adds MFA recovery codes, SCIM tables in v2.197.0","path":"/release/rel_IWYTO7y9-JR3cgUUHkIk3-mfa-recovery-codes-added-scim-tables-land","org":{"slug":"supabase","name":"Supabase"},"importance":3},{"id":"rel_YaJ788vFomZ4O-dAlhdLF","title":"Clerk adds OAuth device authorization grant flow","path":"/release/rel_YaJ788vFomZ4O-dAlhdLF-oauth-device-authorization-grant-flow-added","org":{"slug":"clerk","name":"Clerk"},"importance":3},{"id":"rel_DvmDMEoNTrg5dp0svKKyc","title":"Auth0 adds Deny All rule for Tenant ACL to reject all traffic","path":"/release/rel_DvmDMEoNTrg5dp0svKKyc-tenant-acl-gains-deny-all-fallback-rule","org":{"slug":"auth0","name":"Auth0"},"importance":3},{"id":"rel_Mqb1xyggst-RH9g3WN_gq","title":"@clerk/expo-google-signin v1.0.4 fixes Android Gradle Plugin 9 build failure","path":"/release/rel_Mqb1xyggst-RH9g3WN_gq-android-gradle-plugin-9-build-failure-fixed","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_XX6TSPLfxIPmdNqHbsBhw","title":"@clerk/expo-passkeys v2.0.18 fixes Android Gradle Plugin 9 build failure","path":"/release/rel_XX6TSPLfxIPmdNqHbsBhw-android-gradle-plugin-9-build-failure-fixed","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_xbSO6pQgmlaVBJv2L67f0","title":"Clerk Expo SDK v4.6.6 adds OIDC prompt parameters to useSSO","path":"/release/rel_xbSO6pQgmlaVBJv2L67f0-usesso-now-accepts-oidcprompt-and-oidcloginhint","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_fGngYr0Nb2hf1MhznoiI2","title":"Clerk JavaScript SDK @clerk/shared@4.31.1 adds OIDC prompt and login hint to useSSO","path":"/release/rel_fGngYr0Nb2hf1MhznoiI2-usesso-accepts-oidcprompt-and-oidcloginhint-parameters","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_UCuqc9c3wNeA8xgePDKnG","title":"Clerk JavaScript SDK v6.31.1 completes offline sign-out and updates dependencies","path":"/release/rel_UCuqc9c3wNeA8xgePDKnG-offline-sign-out-completes-when-cached-resources-fail","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_p1xk-lVM10YsGxlqhrMFc","title":"better-auth v1.7.4 adds OpenTelemetry disable flag, Vitest 5 support, and Expo storage fixes","path":"/release/rel_p1xk-lVM10YsGxlqhrMFc-expo-session-storage-fixed-vitest-5-supported","org":{"slug":"better-auth","name":"Better Auth"},"importance":3},{"id":"rel_Uz-oDyTnsiT5OdOqMvYWU","title":"better-auth v1.6.31 adds option to disable OpenTelemetry span creation","path":"/release/rel_Uz-oDyTnsiT5OdOqMvYWU-opentelemetry-spans-now-optional-per-auth-instance","org":{"slug":"better-auth","name":"Better Auth"},"importance":2},{"id":"rel_Uh8y1ZpoiF-y-KkXDwQvD","title":"@clerk/ui v1.32.3 updates dashboard links and fixes passkey autofill errors","path":"/release/rel_Uh8y1ZpoiF-y-KkXDwQvD-dashboard-links-updated-passkey-autofill-error-fixed","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_jFkqo4mANXdUNQpxWfa-j","title":"@clerk/express v2.1.67 updates Dashboard links to active-instance shortcut","path":"/release/rel_jFkqo4mANXdUNQpxWfa-j-dashboard-links-use-active-instance-shortcut","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_N8o0NTlG_maSsrZm7NFtU","title":"Clerk JavaScript SDK v3.17.2 updates dashboard links to active-instance shortcut","path":"/release/rel_N8o0NTlG_maSsrZm7NFtU-dashboard-links-updated-to-active-instance-shortcut","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_qGNvHfC3GA7lpKfqn3fTv","title":"@clerk/upgrade 2.0.6 updates Dashboard links to active-instance shortcut","path":"/release/rel_qGNvHfC3GA7lpKfqn3fTv-dashboard-links-now-use-active-instance-shortcut","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_JN8nIjmWNEpGfcCwiluAj","title":"Clerk Chrome Extension v3.1.82 updates Dashboard links to active-instance shortcut","path":"/release/rel_JN8nIjmWNEpGfcCwiluAj-dashboard-links-switch-to-active-instance-shortcut","org":{"slug":"clerk","name":"Clerk"},"importance":null},{"id":"rel_pCIK3rEgItrSaUcpHf6Vp","title":"Feature Flags Custom Targeting","path":"/release/rel_pCIK3rEgItrSaUcpHf6Vp-feature-flags-custom-targeting","org":{"slug":"workos","name":"WorkOS"},"importance":null}]}}