Clerk takes on fraud while Auth0 opens the door to AI agents

Fraud and abuse moves into the auth flow

The week's biggest story is Clerk's Clerk Protect, a fraud and abuse layer folded directly into sign-up and sign-in. On the Business plan you can now block VPN, Tor, proxy, and hosting-network sign-ups, challenge residential proxies, apply country allowlists and blocklists, cap sign-ups per IP, and reject risky email domains. Every app also gets CAPTCHA challenges for suspicious sign-ups, Device Intelligence checks, account lockout after failed sign-ins, Device Trust, and blocking of email subaddresses and disposable addresses. It's a notable shift: a core identity vendor treating bot and fake-account defense as part of authentication rather than something you bolt on afterwards. Auth0 moved in the same direction more quietly, expanding Bot Detection's IPv6 signal analysis to catch distributed botnets earlier in the flow, with no configuration required.

For the mess that slips through anyway, Clerk added a Backend API endpoint that merges two users into one, moving emails, phone numbers, connected accounts, passkeys, TOTP, backup codes, and organization memberships onto the surviving user before deleting the duplicate. Merges are irreversible, so a dry-run preview and a new webhook keep you honest about what you're about to do.

Auth0 makes its CLI and tenant agent-ready

Auth0's headline this week is Agent Mode for its CLI, a direct response to agents increasingly driving the CLI on developers' behalf. One switch turns on structured JSON output, kills prompts and color, and guarantees a non-zero exit code on failure — closing the gap where a misspelled command used to exit 0 like everything was fine. It also adds stable error codes, a flat command listing, schema introspection, and a docs search, auto-enabling for recognized agent clients. The tenant side got matching treatment: early access for CIMD with dynamic registration, which lets MCP clients and AI agents connect without an admin registering each one first, and Application Profiles to govern refresh token lifetimes, DPoP, and B2B behavior across all those dynamically registered apps from one place. One operator-friendly fix rounds it out: Auth0's configurable Unblock Behavior lets brute-force recovery links require a confirmation click, so headless mail scanners can't consume the link and unblock the account for them.

Passkeys grow up as a second factor

Clerk's JavaScript SDK line had a busy week. The theme worth naming is passkeys as a second factor: during sign-in and session reverification, prebuilt components now preselect a user's passkey when they have one, and custom flows can list passkey in supportedSecondFactors and call authenticateWithPasskey(). The feature isn't preselected where WebAuthn is unavailable, and older instances may need the second factor enabled first. Elsewhere the Expo story is native components moving into their own package, so apps that don't use them stop bundling the iOS and Android SDKs or requiring iOS 17 — a split that pairs with a rewritten native sync where both runtimes share one device token, fixing sessions that signed themselves out and races during token rotation. Rounding things out, the old package names (clerk-react, types, and clerk-expo) are now npm-deprecated in favor of the Core 3 names, and session lifetime handling was corrected so sessions without a maximum lifetime no longer fall back to the current time.

Type corrections and provider polish at Better Auth

Better Auth spent the week tightening edges. Its beta line corrects social profile types across ten providers — VK phone numbers as strings, optional fields for Google ID token claims and others, and new Zoom login types — with breaking changes worth reading before you upgrade. The stable line deprecates tokenEndpointAuthMethod in favor of a structured tokenEndpointAuth object, adds Vercel token-endpoint options and Stripe SDK v23 support, and fixes type declarations that listed type-only exports as values.

The rest of the collection's churn — dependency bumps across Clerk's framework adapters, a handful of Mosaic and UI polish fixes — kept the trains running without changing the story.