# better-auth

Source: https://startwithidentity.com/vendors/open-source/better-auth/
Last updated: 2026-09-20
License: content by Start with Identity. Cite the source URL.

---

## Overview

Better Auth is a framework-agnostic authentication and authorization library for TypeScript, and the current centre of gravity in the JavaScript auth ecosystem. Created in May 2024, it overtook the long-dominant [Auth.js](https://startwithidentity.com/vendors/open-source/authjs/) on both npm downloads (6.09 million weekly against 4.41 million in mid-September 2026) and GitHub stars (30,025 against 28,369) in under two and a half years.

It also absorbed its main rival. Auth.js maintenance transferred to the Better Auth team in September 2025, and [Vercel acquired Better Auth](https://vercel.com/blog/vercel-acquires-better-auth) on 7 July 2026, bringing both libraries under one owner. The library stays MIT licensed.

## What it is good at

Enterprise feature coverage in an open-source library, which is genuinely unusual. The plugin system delivers two-factor authentication with TOTP and backup codes, non-experimental passkeys, organizations and multi-tenancy, admin controls and RBAC, SAML 2.0 through the SSO plugin with assertion replay protection, and inbound SCIM 2.0 for user and group provisioning. That is the shortlist most teams leave a library for, available without leaving one.

Development velocity is high and disciplined: ten releases between mid-August and mid-September 2026, with backports maintained on the previous minor line. Coverage extends into newer territory too, with MCP and agent auth plugins, an OAuth 2.1 provider, and payment integrations for Stripe, Polar and others.

## Where it falls short

Compliance is absent. No SOC 2, ISO 27001 or HIPAA certification is published, and there is no SLA. It remains a library you operate yourself.

The 2026 advisory record is dense: thirteen advisories, nine published on the acquisition date, including a critical CVSS 9.1 OAuth refresh-token replay. Patching is fast and backported, and broad new surface area in a young codebase is the likely explanation, but teams with low risk tolerance should read the list before adopting.

Contributor concentration remains high, with the lead developer at roughly 4.4 times the next contributor's commits, though Vercel employment reduces the usual bus-factor risk.

The open-core shift is worth watching. Better Auth Infrastructure is a paid tier covering dashboards, abuse protection, messaging and enterprise directory sync, with no published pricing.

## Pricing

Library free under MIT. Better Auth Infrastructure is a paid service with unpublished pricing and unstated availability.

## Best for, and who should look elsewhere

Choose Better Auth for new TypeScript projects, including those needing SAML, SCIM, passkeys or multi-tenancy without buying a managed identity provider. Choose [Ory](https://startwithidentity.com/vendors/open-source/ory/) or [Keycloak](https://startwithidentity.com/vendors/open-source/keycloak/) for a fully open-source platform, or [Auth0](https://startwithidentity.com/vendors/ciam/auth0/), [Clerk](https://startwithidentity.com/vendors/ciam/clerk/) or [WorkOS](https://startwithidentity.com/vendors/ciam/workos/) when you need an SLA and compliance certifications.

## Bottom line

The strongest open-source authentication library available and the default recommendation for new TypeScript projects, now Vercel-owned, with enterprise features a library has no business having and a compliance story it does not yet have at all.