react-brainAuthentication & identity — sessions, OAuth, managed vs self-hosted
draftedconfidence: lowearly: 2/14 of this tier graded so far (0 overturned) — the public scorecard →
recommendation
Self-hosted TypeScript auth → Better Auth; managed auth with prebuilt UI and orgs/MFA out of the box → Clerk (web + Expo SDKs). If the backend already bundles auth (Supabase / Firebase), use that instead of adding a second identity system. Lightly vetted as an entry (confidence: low) — though the options themselves are mature.
- new self-hosted / own-database auth → Better Auth (TS-first, framework-agnostic; 2FA/passkeys/orgs via plugins)
- already on NextAuth / Auth.js → maintenance under Better Auth's stewardship (security + bug fixes continue); plan the migration to Better Auth rather than deepening the investment
- managed service / fastest ship / prebuilt sign-in UI → Clerk (per-MAU pricing; @clerk/clerk-expo on RN)
- enterprise SSO / SAML / an existing IdP → Auth0 (react-native-auth0 on RN)
- backend is Supabase or Firebase → its bundled auth
- on react-native-firebase < 26 → v26 requires the New Architecture and drops the namespaced API (firebase.auth() → getAuth(app)); if you can't enable New Arch yet, stay on v25 deliberately
- hand-rolling OAuth/sessions (expo-auth-session or custom) → read the Copenhagen Book first; session tokens live in Keychain/Keystore (RB-E-STORAGE), never AsyncStorage (RB-E-SECURITY)
- P2P / Holepunch app → no auth server: identity is keypair-based → RB-E-P2P
- agent-facing product (AI agents authenticating to your app) → watch Agent Auth Protocol (Better Auth × Vercel) — early, not a bet yet
Low confidence — fast-moving or lightly-vetted domain: treat the pick as a vetted lead and prototype before committing.
Options & tradeoffs
| option | tradeoff | evidence |
|---|---|---|
| Better Auth | TS-first, framework-agnostic, self-hosted (your DB owns the users); 2FA/passkeys/organizations via plugins; acquired Auth.js and JOINED VERCEL 2026-07 with a stated open-source + framework-agnostic commitment; 1.7.0 (2026-08-18) moves the joins flag out of experimental to advanced.database.joins — a config rename if you opted in; very active | 4.7M/wk · ships in 1/34 |
| Auth.js / NextAuth (maintenance) | the long-time Next.js default — now under Better Auth's stewardship: security + bug fixes continue but the stated path is transitioning users to Better Auth; registry shows the cadence (@auth/core last publish 2025-10) | |
| Clerk | managed auth SaaS with prebuilt React components (sign-in, orgs, MFA) + a first-class Expo SDK (@clerk/clerk-expo); fastest to ship; per-MAU pricing + vendor dependency | ships in 1/34 |
| Auth0 (react-native-auth0) | the enterprise IdP — SSO/SAML/federation; RN SDK active (v5.10, 2026-07, adds MFA support; v5.9 added passwordless OTP for database connections) | 139k/wk |
| backend-bundled — Supabase Auth / Firebase Auth | already included with the backend (@react-native-firebase/auth on RN, v26.x); use it rather than bolting on a second identity system. v26 (2026-08-07) is a hard line — see note | 239k/wk · ships in 1/34 |
| expo-auth-session (DIY) | Expo's browser-based OAuth/OIDC primitive — the hand-rolled lane on RN; you own token/session handling (Keychain via RB-E-STORAGE) and the correctness burden (see reading) | 1.4M/wk · ships in 1/34 |
Migration lines
@react-native-firebase/* < 26.0.0 → React Native Firebase v26 (TurboModules + modular API)
v26 makes every natively-bridged package New-Architecture-only and removes the namespaced API — bump the packages together, switch firebase.auth()-style calls to modular getAuth(app), and drop .then() where the TurboModule API is now synchronous. Below New Arch the supported position is to stay on v25.
npm weekly downloads (from the corpus's last signals run): better-auth 4.7M · next-auth 5.1M · react-native-auth0 139k · expo-auth-session 1.4M · @react-native-firebase/auth 239k
Verified notes
NEW entry (2026-07-16), triggered by TWiR #290: Better Auth JOINED VERCEL (2026-07-07, verified vs the first-party announcement — open-source + framework/platform-agnostic commitment stated; their Agent Auth Protocol work continues under Vercel). This completes a stewardship consolidation: Better Auth had ALREADY acquired Auth.js/NextAuth and commits to maintaining it (security/bugs) while transitioning users toward Better Auth. The registry corroborates the two lanes (2026-07-16): better-auth 1.6.23 active vs @auth/core last published 2025-10, next-auth 4.24.x 2026-04. DELIBERATE NO-MIGRATE-RULE (same policy as ANIMATION's Rive case): Auth.js is NOT formally deprecated — add the next-auth → better-auth migrate rule if/when a formal deprecation or EOL lands; until then it is a when-clause, not churn. Auth was a domain GAP — no entry covered it among the prior 42. REACT NATIVE FIREBASE v26 (2026-08-07, verified vs the Invertase release post): the biggest architectural cut in the library's nine years, and it is gated — every package with a native bridge now REQUIRES the New Architecture (Codegen TurboModules), so v26 is only reachable once the app is on New Arch; the maintainers' explicit advice otherwise is to stay on v25. Three changes travel with it: all 19 packages migrated JS→TypeScript (the prerequisite for TurboModule specs), the deprecated NAMESPACED API is removed so modular calls (getAuth(app)) are the only surface — matching the firebase-js-sdk docs people already copy from — and CI now diffs the TypeScript shapes against firebase-js-sdk so API drift fails on Invertase's side instead of in your build months later. One migration trap worth knowing: TurboModules let APIs be synchronous where firebase-js-sdk is synchronous, so code calling .then() on what is now void breaks.
Canonical reading
Editorial annotations on why each piece matters — the articles themselves are the originals; read them there.
The free, open, community-maintained guideline for implementing auth from first principles — server-side tokens, sessions, password auth + reset, email verification, OAuth, MFA, WebAuthn, CSRF, open redirects — meant to be read alongside the OWASP cheat sheets. THE canonical reference when you hand-roll any part of auth instead of adopting a library above; its author sunset the Lucia auth library INTO this book, the lesson being that auth is a design problem more than a dependency.
Carries a PLATFORM deprecation this entry had no home for: Android's legacy GoogleSignInClient (Google Play services) is deprecated and slated for removal, with Credential Manager as the replacement — and much of the existing RN Google-sign-in field still targets the old API, so it misses Credential Manager's bottom-sheet flow, automatic sign-in and structured error handling. The post introduces the authors' own @thoughtbot/react-native-social-auth (Credential Manager on Android, Google Sign-In SDK 8+ on iOS with Firebase App Check and custom nonces, TypeScript-first, Expo config plugin), so treat the library pick as vendor advocacy; the deprecation and the capability checklist are the durable part. It stops at obtaining the credential — session/token handling is still yours (Keychain via RB-E-STORAGE, never AsyncStorage).
Sources
- github.com/better-auth/better-auth/releases/t…
- invertase.io/blog/react-native-firebase-v26-rel…
- github.com/auth0/react-native-auth0/releases/…
- better-auth.com/blog/better-auth-joins-vercel
- registry.npmjs.org/better-auth/latest
- registry.npmjs.org/@auth%2Fcore/latest
Related in app-architecture: state · data · p2p · nav · meta-frameworks · forms · networking · crossplatform · desktop