Better-auth bought and arctic deprecated, recommendations for oauth?

They are both deprecated, actually. At least Auth.js recommends using Better-auth for new projects.

Auth.js is still actively maintained under Better Auth, isn't it? And Lucia's author now recommends Better Auth as well. What would you recommend instead?

lucia-auth is still around, no? been using it for a side project and it does the job with discord oauth just fine

Note: Auth.js is also a project of Better Auth nowadays and provides a migration path to better auth. Therfore I wouldn’t got for that route and would either stick to better auth itself or build your own 👍🏻

lucia was deprecated within the last week.

This is actually the right answer and the whole "don't roll your own auth" thing has scared people away from what is - in the case of oauth - actually a safer long-term path than using a third party library. If your framework has a very long-maintained well designed useful auth framework than use that - I would generally use devise in rails for example - but generally given the state of library security and longevity these days - i would never use a random library for this in 2026, and definitely not a third party service unless there's some other compelling business reason.

Better auth isn’t a random library lol, it’s a massively successful YC startup that is now owned and supported by one of the best open source stewards in the world.

This might not be something you want to hear, but have you tried implementing it yourself? OAuth is mostly sending requests and parsing responses. There’s not a lot of footguns. Maybe state validation, but you were already doing that manually with Arctic. The most confusing part might be finding the right docs, and maybe PKCE if you’re not used to hashing and working with binary data. Just remember to use a cryptographically strong RNG when generating states and PKCE code verifiers

Roll your own 😊 Lucia-auth teached me a lot and I got a lot of control on authentication, I love it!

Zitadel (AuthN with OAuth) and OpenFGA (AuthZ) was used in my most recent project.

You can checkout ideal-auth https://ramonmalcolm10.github.io/ideal-auth/

I'd recommend Auth.js or Lucia Auth. Both are actively maintained, self-hostable, and support OAuth providers like Discord and Reddit. If you only need OAuth, either of them should work well.

Who cares if better auth was purchased, Vercel makes a lot of open source software that you don’t have to pay a dime to use. Better auth will probably only improve from here it’ll just also get really solid Vercel integration.

Given how quickly AI can spit out some endpoints nowadays, I would just implement your flow yourself. It’d just not that difficult, and you can free yourself of another dependency bound for enshittification 😂

I'm pretty sure if i suggest passport.js im going to get shot in this comment section.

这条评论已被删除。