Auth platforms turn to protecting accounts, not just creating them

Self-service moves into the platform

The week's biggest shift came from Auth0, which launched Universal Portals in Developer Preview. Instead of hand-building account settings screens, tenants get hosted portals assembled from pre-built components on a URL on their own domain: consumer portals for profile updates, MFA factor and passkey enrollment, and security settings, and business portals where organization admins edit org details and verify domains. It's the kind of surface almost every team ends up rebuilding badly, so moving it into the platform is a meaningful reduction in custom code.

Clerk pushed in the same direction at the organization level. Across its shared, UI, and core JS packages, it decoupled Directory Sync from the SSO flag, so self-serve Directory Sync is now controlled per organization rather than following self-serve SSO — and the OrganizationProfile Security page now appears for Directory Sync-only orgs while SSO-only orgs stop seeing the section. The Mosaic component set got the same behavior in its own pass.

Stronger factors, fewer fake signups

Clerk made passkeys a second factor for MFA: users who sign in with a password, social connection, or reset code can now satisfy the second step with a passkey instead of SMS or an authenticator app, including during reverification, and custom flows can list passkey in supportedSecondFactors. It requires recent clerk-js and UI versions and dashboard opt-in for older apps.

Clerk Protect gained two sign-up limits that work across IPs: an hourly cap per email domain and a cap on bursts that appear to come from shared infrastructure, both on the Business plan, complementing the existing per-IP limit. On the client side, sign-in and sign-up now wait up to 10 seconds for Device Intelligence instead of 5, so slow connections are less likely to get blocked — and a late-arriving result is now kept for the next attempt rather than discarded.

Auth0 hardened its network edge for Enterprise tenants with RFC 9421 HTTP Message Signatures in Tenant Network ACLs, verifying at the Auth0 boundary that requests came from an authorized proxy or gateway and dropping direct traffic, with multiple active keys for zero-downtime rotation. It also added SMS fraud protection with exponential backoff for Phone MFA, replacing static send limits with compounding cooldowns that scale to 32 minutes against toll fraud.

Agents, logs, and mobile

Clerk opened a private beta for Agent Auth, built on OAuth standards and the Personal Agent Protocol, letting agents discover an app and be authenticated by Clerk. Its Application Logs endpoint became public as GET /v1/logs, so you can query events from code or an agent, subject to rate limits. The iOS SDK added enterprise SSO connection selection and fixed email-link sign-ins dropping the session's organization, while also redacting tokens from verbose logs.

Better Auth's week was mostly fixes: a prototype pollution error affecting org and API key metadata, plus tightened Stripe redirect validation; SAML ACS callbackUrl sign-in and stateless OAuth token retrieval; and imported Base32 TOTP secrets now accepted alongside a Kakao loginHint fix. Its beta line is reworking Paybin, Spotify, and Twitch profile mapping, with an action item for custom ID-token sign-ins. And a security release is scheduled for November 3 — worth calendaring.