Clerk tightens session control as Better Auth hardens its core

Session control gets granular

Clerk's biggest theme this week was making session lifetimes settings you can actually aim. Per-session expiry overrides let you set one session's expire_at anywhere from five minutes to ten years through a new Backend API endpoint, with new session token shortcodes exposing a session's age and expiry to custom claims. Alongside it, native sessions now have their own maximum lifetime separate from web browser sessions — handy for shared devices and long-lived mobile apps, though the setting is a paid-plan feature in production.

The same instinct shows up on mobile: minimum app version enforcement lets you pin a floor per iOS and Android app from the Dashboard, blocking old builds with an update screen while keeping users signed in. The iOS SDK's update screen landed the client side, and the iOS device-token and magic-link fixes keep identity intact when the cached client is unreadable or a resend is rejected.

Better Auth's security sweep

Better Auth spent the week in the weeds of session correctness, and the aggregate is a meaningful hardening pass. Revoked sessions can no longer linger via secondary storage or the cookie cache, phone numbers are stored only after verification, and OAuth's string "false" is no longer read as verified. Follow-ups tightened revoke-all-sessions races, then remembered sign-ins, phone linking, and TOTP with API key sessions. The newest beta goes further on OAuth: repeated authorize parameters in form POSTs now return invalid_request instead of silently using the last value.

Logs, groups, and directory sync

Clerk's observability story widened. Email events are now in Application Logs and GET /v1/logs, filterable by recipient, and sign-ins and sign-ups collapse into single rows with event counts and outcomes (pass view=flat for the old shape). Directory Sync gained group webhooks and a pause switch, and the backend ships typed narrowing for those group events.

SDK housekeeping worth noticing

The JavaScript SDK's 10-second React Native token timeouts and safer sign-out avert hangs, the Chrome extension SDK stops loading Device Intelligence scripts remotely, and Mosaic added drag-and-drop avatar and logo uploads. Two changes ask for migration: rootAuthLoader no longer takes an options argument in React Router, and Apple sign-in now throws when email verification is required instead of failing silently. A broad wave of dependency bumps carried the rest of the week, plus a single Auth release candidate with no notes to speak of.