Better Auth

Better Auth: frequently asked questions

Who owns Better Auth?

Vercel, since 7 July 2026. Vercel states the founder Bereket Engida and the core team joined the company and that the library stays free and MIT licensed. Before that, Better Auth raised a 5 million dollar seed round led by Peak XV Partners with Y Combinator, Chapter One and P1 Ventures in June 2025, so it went from seed to acquisition in about twelve and a half months. The acquisition price was not disclosed. Note that Better Auth also took over maintenance of Auth.js and NextAuth.js in September 2025, so both libraries now sit under the same ownership.

Is Better Auth free and will it stay that way?

The library is MIT licensed and Vercel explicitly committed to keeping it free and MIT at acquisition. However, Better Auth is now open-core rather than purely open source: there is a paid product called Better Auth Infrastructure, described in the documentation as a service adding a management dashboard, abuse protection covering credential stuffing, bots, disposable email and impossible travel, transactional email and SMS delivery, and enterprise features including SSO, SAML, directory sync via SCIM, log drains and role-based dashboard access. Pricing, availability status and whether it is billed by Vercel are not stated on the documentation page we reviewed, so ask directly.

Is Better Auth more popular than Auth.js now?

By the measurable signals, yes. For the week of 13 to 19 September 2026, better-auth recorded 6,093,492 weekly npm downloads against next-auth's 4,409,327. It also passed Auth.js on GitHub stars, 30,025 to 28,369, despite being roughly four years younger; the repository was created in May 2024. Release cadence tells the same story: Better Auth shipped ten releases between 17 August and 14 September 2026, with backports to the previous 1.6.x line, while Auth.js last released on 20 July 2026.

Does Better Auth support enterprise features like SAML and SCIM?

Yes, through its plugin system, and this is the clearest gap it fills versus Auth.js. The SSO plugin supports OpenID Connect, OAuth2 providers and SAML 2.0, with SAML assertion replay protection always enabled and each assertion ID tracked and rejected on reuse. A SCIM plugin provides an inbound SCIM 2.0 service for creating, updating, deactivating and deleting users and groups, with one nuance worth knowing: a SCIM user does not create an authentication account, so the user still needs SSO, a passkey or credentials to sign in. Organizations and multi-tenancy, admin controls and RBAC are all covered by plugins, as are 2FA with TOTP and backup codes, and passkeys, the latter not flagged experimental unlike Auth.js.

What is in the plugin catalogue?

Grouped as the documentation groups them: authentication plugins cover 2FA, username, anonymous, phone number, magic link, email OTP, passkey, generic OAuth, One Tap and Sign In With Ethereum. Authorization covers admin, agent auth, API key, MCP and organization. Enterprise covers an OAuth 2.1 provider, client ID metadata document, SSO and SCIM. Utility plugins include bearer tokens, device authorization, captcha, Have I Been Pwned, i18n, multi-session, OAuth proxy, one-time tokens, OpenAPI and JWT. There are also payment plugins for Stripe, Polar, Chargebee and several others.

How is Better Auth's security record?

Denser than Auth.js in 2026, and worth reading carefully rather than as a simple negative. Thirteen advisories exist, nine of them published on 7 July 2026, the same date as the Vercel acquisition announcement, which is consistent with a coordinated security audit disclosed at the transaction; we note the co-occurrence without asserting causation. The most severe was CVE-2026-53512, critical at CVSS 9.1, an OAuth refresh-token replay through missing client authentication, fixed in 1.6.11. Others in the high range covered insecure cryptographic defaults in the OIDC provider, account takeover through pre-account hijacking and through OAuth auto-link to unverified emails, an authorization-code redemption race and a rate-limiter IPv6 bypass. The fair reading is broader enterprise surface area plus young code, with fast patching and backports to the previous minor line. No Better Auth entry appears in CISA KEV.

Is Better Auth production-ready for enterprise use?

The library is stable, currently 1.7.5 released 14 September 2026, and covers enterprise authentication features that Auth.js does not. What it does not have is compliance: we found no SOC 2, ISO 27001 or HIPAA certification published on better-auth.com, and no SLA. It remains a library you run yourself, so you own the operational and compliance burden, though the paid Infrastructure tier moves some of that. Contributor concentration is also worth noting: the lead contributor has roughly 4.4 times the commits of the next, though the core team is now salaried at Vercel, which mitigates the usual single-maintainer risk.

What are the best Better Auth alternatives?

Auth.js if you already run it and need no enterprise features, though its maintainers now point new projects at Better Auth. Ory or Keycloak for a fully open-source self-hosted platform with no commercial tier. Auth0, Clerk or WorkOS when you want a managed service with an SLA and compliance certifications rather than a library. Lucia and Supabase Auth for lighter-weight alternatives. The real dividing line is library versus service: Better Auth is a library with an emerging commercial layer, not a managed identity provider.