Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auth.js is now part of Better Auth

better-auth.com

Post reply on HN
Print view View original

41–50 of 87 posts

Re: Auth.js is now part of Better Auth

#41

Post by [deleted] »

subsection1h wrote: post #32
reilly3000 wrote: post #12

Better Auth has raised $5M. I don’t think it’s great to see a truly free project get absorbed into a commercial venture.

> I don’t think it’s great to see a truly free project get absorbed into a commercial venture. Auth.js and NextAuth.js didn't seem to be in a healthy state. Work on NextAuth.js v5 began way back in May 2023.[1][2] NextAuth.js v5 was renamed to Auth.js in August 2023.[3] v5.0.0-beta.0 was released in October 2023.[4] Balázs Orbán, the main contributor to Auth.js and NextAuth.js, quit in January 2025.[5][6] v5 is still…

[deleted]

Re: Auth.js is now part of Better Auth

#42

Post by bekacru »

presentation wrote: post #39

I am bummed by this, basically sounds like they’re sunsetting future development into Auth.js. I tried Better Auth and it was not usable for what I wanted to do - I manage my own database schema and expose it through a permissioned GraphQL API. With Auth.js I just needed to implement a documented set of functions with specified input and output types, like creating users, storing tokens, etc. - however I wanted to -…

1. We won’t sunset Auth.js unless we’re confident that anyone currently using it can migrate to Better Auth without any issues, which is quite difficult right now. So we don’t expect to do that anytime soon and chances are we will never require everyone to migrate.

2. The features we offer through plugins don’t exist in NextAuth, so that shouldn’t be a problem. You can use the core library for almost all of NextAuth’s features, and we provide most plugins first-party. Of course, you can choose not to use a plugin, write your own, copy and modify one, or only use the first-party ones we provide. We handle the database so you can own your auth without writing the logic yourself.

3. Auth.js hasn’t been actively maintained for a while. Our main reason for bringing it under Better Auth was to avoid a sudden deprecation, as that would directly harm the open-source auth ecosystem by eroding trust. Something we’ve already seen happen on a smaller scale with Lucia Auth.

Re: Auth.js is now part of Better Auth

#43

Post by pmdr »

kbumsik wrote: post #20
dzonga wrote: post #5

only in javascript where auth is such a big issue. in rails you can use the rails 8 auth or a better alternative authentication-zero. before it was devise. java - spring security, shiro etc. but just complex things. alternatively - use services like fusionAuth

In case if you don't know, Auth.js is not a frontend-only framework. It uses a backend server to make it secure. So it basically has no difference from the alternatives you mentioned.

> make it secure

It's convenient, I'll give them that. Secure? https://projectdiscovery.io/blog/nextjs-middleware-authoriza...

Re: Auth.js is now part of Better Auth

#44

Post by presentation »

bekacru wrote: post #42
presentation wrote: post #39

I am bummed by this, basically sounds like they’re sunsetting future development into Auth.js. I tried Better Auth and it was not usable for what I wanted to do - I manage my own database schema and expose it through a permissioned GraphQL API. With Auth.js I just needed to implement a documented set of functions with specified input and output types, like creating users, storing tokens, etc. - however I wanted to -…

1. We won’t sunset Auth.js unless we’re confident that anyone currently using it can migrate to Better Auth without any issues, which is quite difficult right now. So we don’t expect to do that anytime soon and chances are we will never require everyone to migrate. 2. The features we offer through plugins don’t exist in NextAuth, so that shouldn’t be a problem. You can use the core library for almost all of NextAuth’…

I guess what I’m saying is that I think the part about delegating databases to Better Auth relegates it to being only useful for throwaway projects and companies with low quality technical vision, and there is no actively developed alternative that can do any better.

Patches are better than nothing but I am disappointed with the state of auth in JS.

Re: Auth.js is now part of Better Auth

#45

Post by agolio »

subsection1h wrote: post #32
reilly3000 wrote: post #12

Better Auth has raised $5M. I don’t think it’s great to see a truly free project get absorbed into a commercial venture.

> I don’t think it’s great to see a truly free project get absorbed into a commercial venture. Auth.js and NextAuth.js didn't seem to be in a healthy state. Work on NextAuth.js v5 began way back in May 2023.[1][2] NextAuth.js v5 was renamed to Auth.js in August 2023.[3] v5.0.0-beta.0 was released in October 2023.[4] Balázs Orbán, the main contributor to Auth.js and NextAuth.js, quit in January 2025.[5][6] v5 is still…

That may be true but doesn't contradict the point of the parent commenter.

If Auth.js wanted to give up, that would be fine (although disappointing, since multiple options is always healthy, especially for something as critical as auth)

but this deal where they are "becoming part of BetterAuth" and recommending that new users use BetterAuth on the project README is concerning to me

Re: Auth.js is now part of Better Auth

#46

Post by bekacru »

presentation wrote: post #44
bekacru wrote: post #42

Earlier quoted context omitted.

1. We won’t sunset Auth.js unless we’re confident that anyone currently using it can migrate to Better Auth without any issues, which is quite difficult right now. So we don’t expect to do that anytime soon and chances are we will never require everyone to migrate. 2. The features we offer through plugins don’t exist in NextAuth, so that shouldn’t be a problem. You can use the core library for almost all of NextAuth’…

I guess what I’m saying is that I think the part about delegating databases to Better Auth relegates it to being only useful for throwaway projects and companies with low quality technical vision, and there is no actively developed alternative that can do any better. Patches are better than nothing but I am disappointed with the state of auth in JS.

NextAuth has supported delegating your db for years, companies like cal.com, deel.com and many others use that directly (not just for stateless jwt). I don’t really see the difference here, except that we handle more for you. And of course, If you don’t want to delegate your database, you can keep using NextAuth with stateless auth and we plan to add support for that as well.

There are already many companies with lots of users and revenue using Better Auth from simple auth setups to organizations, billing and what not.

If your question is more about whether we should allow database adapters to be written directly by developers (some people ask that) that’s just not realistic at the scale of what we handle. No one is realistically going to write hundreds of queries manually

Re: Auth.js is now part of Better Auth

#47

Post by presentation »

bekacru wrote: post #46
presentation wrote: post #44

Earlier quoted context omitted.

I guess what I’m saying is that I think the part about delegating databases to Better Auth relegates it to being only useful for throwaway projects and companies with low quality technical vision, and there is no actively developed alternative that can do any better. Patches are better than nothing but I am disappointed with the state of auth in JS.

NextAuth has supported delegating your db for years, companies like cal.com, deel.com and many others use that directly (not just for stateless jwt). I don’t really see the difference here, except that we handle more for you. And of course, If you don’t want to delegate your database, you can keep using NextAuth with stateless auth and we plan to add support for that as well. There are already many companies with lot…

Sorry for being dismissive - but I think that’s just a failure of imagination.

Does every app using an adapter for Better Auth need to implement every plugin’s many thousands of operations, even if they’re only using basic functionality and a handful of operations?

Auth.js differed in that you could let them handle it if you’re doing your low impact side product, but once you did care you can opt out. You’re telling me that Better Auth knows better what you need than you do, and so giving you the option to opt out would just be too onerous for you to decide if you want to do it or not.

Why couldn’t Better Auth plugins individually declare what they need and let you implement those functions as you need them?

For what it’s worth my company also makes money in a sensitive industry, Auth.js did everything we need regarding authentication (and we just use other things entirely for billing/etc, which arguably is much more modular), and we only had to implement like 8 functions that took a day and has worked since we started a few years ago. Probably would take me an hour or two today thanks to AI.

Honestly I’m fine with Better Auth taking its stance, but basically saying “you should use Better Auth unless you have this one random fad technical issue, why would you need any alternative like Auth.js??” while saying that there will only be security patches; and no real probable alternative I can think of; and that stance is basically a non starter for what I believe to be a large set of use cases, rubbed me wrong.

I’ll take patches over nothing, but that doesn’t invalidate my feeling that auth in JS is in a sorry state and this isn’t making it better as far as my concerns go. Anyway who am I to talk, I’m not going to make an alternative regardless.

Re: Auth.js is now part of Better Auth

#49

Post by presentation »

dzonga wrote: post #5

only in javascript where auth is such a big issue. in rails you can use the rails 8 auth or a better alternative authentication-zero. before it was devise. java - spring security, shiro etc. but just complex things. alternatively - use services like fusionAuth

Part of it is that most of the libraries that came before we’re tightly coupled to a particular framework that itself went out of fashion, like Passport and Express, which is a problem because frameworks themselves have been moving in and out of fashion very rapidly; or are coupled with service offerings from vendors, like Auth0.

Auth.js is actually one of the first attempts that tries to be framework and vendor agnostic while still including a good deal of the batteries you need to make a full authentication system, which they only recently did, as they were originally tied to next JS like every other library in the graveyard of authentication libraries.

If you just want to specifically do an OAuth handshake or salt and hash a password or produce a JWT, those libraries are all rock solid. But a full batteries included framework and vendor agnostic solution hasn’t really existed until recently.

Re: Auth.js is now part of Better Auth

#50

Post by re-thc »

BoorishBears wrote: post #33
joshdavham wrote: post #23

Earlier quoted context omitted.

> I’ve seen this game plan often enough. I probably haven't been around as long as you. Could you provide an example of one that comes to mind?

Auth.js: Vercel hired the lead dev and it stopped improving, leading to better-auth

Time for Vercel to hire the lead dev of Better Auth next?
Post reply on HN