Birbla

Discussion summary

Better Auth is joining Vercel amid mixed opinions. Some users criticize its codebase, while others suggest building custom auth solutions or using third-party libraries.

What the discussion says

  • Some users find Better Auth's codebase problematic.
  • Others believe auth can be easily rolled or managed with libraries.
  • Concerns about security and complexity in building auth solutions.
“Better auth is an absolute dumpster fire codebase.”
— huflungdung
“Auth is not hard to roll yourself. Crypto: don't do it. Auth? Easy peasy.”
— whalesalad

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • Congrats to Better Auth. I'm in the auth space and see all kinds of things.

    Anything that makes it easier for developers to build secure applications is a win!

    by mooreds
  • can Vercel give any assurance that they won’t add a reliance on their closed-source cloud offering for the package? especially given their ownership of next-auth too

    i really loved better-auth’s DX but the nature of their database adapters means it’s relatively easy to switch over to another provider/library

    by bstsb
  • From what I remember, next-auth is kind of dead and Better Auth developers have been maintaining security of next-auth for some time now. (or was it Vercel that did the maintaining?)

    Better Auth is the go-to solution for many people using Nextjs, so it makes sense that Vercel puts some effort in maintaining it.

    I have never had issues running Nextjs in regular containers, it is just a good open source solution, I don't see why it would be any different with Better Auth.

    by Jnr
  • How is BetterAuth in terms of vendor lockin? For a hobby project, I once tried a provider which stored all data within itself and required API calls for every user request. Then I tried Hanko which just authenticates and can be replaced relatively easily (very easily if no passwords IIRC).
    by aitchnyu
  • It sounds like they just joined Vercel.
    by xtajv
  • Thanks for mentioning Hanko. Data minimalism is one of our core values, so I’m really happy to see that appreciated.
    by FlxMgdnz
  • I nearly considered using them recently. So glad I dodged the bullet!
    by mrcwinn
  • Umm.. so what did you end up using?
    by electriclove
  • Ain't nobody buying Jose, yet
    by ftchd
  • Is rauch planning to control Open source, why are we seeing more acquisitions. Also Is this the time they officially announce the death of Auth.js?
    by Tomy9
  • So, it's just a matter of time until they destroy this project in favour of their cloud interests. Such a shame, it is (was) a nice open source project.
    by mariopt
  • Reminder - KeyCloak was donated to CNCF so a safe choice

    https://www.keycloak.org

    https://www.cncf.io/blog/2023/04/11/keycloak-joins-cncf-as-a...

    by khurs
  • Is keycloak still the only real game in town for open source authorization (not authentication; that part is totally fungible)?
    by kommunicate
  • Keycloak is awesome, but whenever I used it the documentation gave me too little guidance. On how to use it in the right way, without having to customize it too much.
    by andix
  • I really want to love KeyCloak. I've had really bad experiences with weird uptime bugs and crash loops that kept me from giving it an honest retry over the last couple years.

    It also really shows its age, imo. The interface is clunky, roles and groups having overlapping responsibilities is confusing, making custom UIs for it makes me feel ancient, etc.

    I really can't complain though. There is simply no alternative that's as open atm. It's also not easy to make one ( I tried :( ).

    by vaishnavsm
  • how is this related to better auth ? In my understanding, keycloak and better auth are fundamentally different. I would compare keycloak more with Ory for example.
    by nvegater
  • I used Better Auth for my mobile app backend. It works okayish. My biggest complaints are the OpenAPI specification gets little care, as it mainly caters for JS frontend, and breaking changes in patch version are more common than most packages.
    by magnio
  • Bereket Here

    the team at Vercel has been my biggest inspiration and always reflected many of the reasons we started working on Better Auth. This would allow us to focus more on what made better-auth great in the first place It hasn't even been 2 years since we started but thank you everyone from the open-source community for helping us make an impact in short amount of time. There is a lot to do to improve on open source auth and im really excited to be back focusing full time on building

    by bekacru
  • You're saying that BetterAuth will remain 100% free and open source, will continue to be maintained, and unlocked from Vercels ecosystem?
    by oooyay
  • Hi Bereket,

    Congratulations on the acquisition!

    We are building auth for developing markets (secure MFA for users without smartphones).

    Would love to get your thoughts on the auth landscape.

    I'm +254-seven-zero-seven-144992 on WhatsApp.

    Cheers!

    by Aroni
  • what will be your role at Vercel? Aren't you afraid that you might lose control over the project's future - becoming a cog in a much more complex system?
    by orliesaurus
  • Bummed. Vercel is not a great steward of open source. Happy that Bereket got an exit, though.
    by jgeurts
  • How so? I am using their open source software, what have I missed?
    by Jnr
  • Congrats BetterAuth! It was the system I was considering before I rolled my own auth system around the passwordless concepts of: OTP + Passkeys + Google login. It is quite nice and simple and I've ported it to 3 separate projects now just via LLM:

    Talk: https://ben3d.ca/blog/passwordless-login-system

    Live Demo: https://passwordless.ben3d.ca

    Demo Code: https://github.com/bhouston/passwordless

    If you are building a user system with a database already, adding passwordless auth is easy.

    by bhouston
  • That demo code looks great -- please add a license :)
    by noveltyaccount
  • On one hand I love how much easier the email + OTP / passkey flow is on the dev side, I find it _very_ frustrating as a user of services. User+password combos are straightforward at least.
    by quibono
  • Open source isn't really open any more. It's just pre-acquisition. I'm happy to the creators for their payday but honestly just happy I opted out of BetterAuth building my latest product.
    by nightski
  • Is it about the license? I see less and less new projects using GPL, and a lot of MIT(ish) licenses.

    Most complex open source projects like Linux for example have a lot of contributions by corporations. The GPL kind of forces them to participate in open source, instead of just creating internal forks.

    GPL and even LGPL are tricky for libraries though.

    by andix