riivault_/ENTITY 4405
● Liveproductauth / identityrepo:better-auth/better-authnpm:better-auth
Entity drill-down · last 90 days ·30d90d180d

Better Auth

Hype · Discussion moved +68.0% while downloads moved -21.2%. (as of 2026·08·12)

Narrow: 141 distinct voices behind 489 mentions.

Who is talking
0.29
141 distinct voices across 489 mentions

Distinct voices per mention. 1.00 means every mention came from a different person; a low number means a handful of people are driving the volume. Authors are counted once per day, so someone who posts across several days counts more than once over the whole window. The figure can overstate breadth, never understate it.

Where it is being said
github100%

A wave of praise on a forum and a rapidly filling issue tracker both show up as “mentions up” until you see where they came from.

Agreement
Aligned
spread 0.48 · sides 18% even

Most opinion points the same way, so the average sentiment reads as a verdict rather than two sides cancelling out.

SRC: 834 mentions in window · net sentiment 0.29 · 3 adoption series · derived aggregates only

Mentions / dayall sources combined
05-1907-2108-12
latest 39 mentions05-19 .. 08-12
Sentiment curve0.29 current
05-1907-2108-12
latest 0.2905-19 .. 08-12
GitHub releases / dayadoption
05-2906-2008-11
latest 205-29 .. 08-11
GitHub stars (total)adoption
08-0608-0908-12
latest 29.5k08-06 .. 08-12
npm downloads / dayadoption
07-0707-2308-09
latest 681.0k07-07 .. 08-09
What people are asking forlatest 20 entries
What was saidKindTimesFirst / LastMomentum
The adapter's numeric ID coercion under generateId serial has no validity check and crashes with confusing errors on non-numeric values.Bug108-12 → 08-12+0%
Proof of Work implementation uses the crypto module which is not available in Expo/React Native environment.Bug108-12 → 08-12+0%
The expoClient no longer satisfies the BetterAuthClientPlugin type contract since version 1.6.24, causing type-checking failures.Bug108-12 → 08-12+0%
Drizzle adapter with experimental.joins throws Unknown relational filter field decoder on drizzle-orm v1.Bug208-06 → 08-11+100%
The idToken field is not encrypted when account.encryptOAuthTokens is enabled, unlike accessToken and refreshToken.Bug108-11 → 08-11+0%
Query parameters are dropped when the query schema is wrapped in z.optional() because the type check only handles z.ZodObject directly.Bug108-10 → 08-10+0%
Email confirmation steps should be added for organization deletion and ownership transfer operations, similar to the existing user deletion confirmation flow.Feature request108-10 → 08-10+0%
A passwordless enrollment flow is needed that proves email ownership and then allows password setting as a single primitive for sign-up, admin-created, and org-invited users.Feature request108-10 → 08-10+0%
useSession creates thousands of aborted get-session requests during uncached production reloads.Bug108-10 → 08-10+0%
stopImpersonating restores a browser-session cookie without Max-Age on the second impersonation and subsequent cycles.Bug108-10 → 08-10+0%
The oauth-provider plugin resolves JWKS inconsistently across different endpoints, using in-process resolution in introspection and revocation but making outbound HTTP requests in RP-initiated logout.Pain point108-10 → 08-10+0%
Better Auth should implement account-based rate limiting to protect individual accounts from distributed brute-force attacks in addition to existing IP-based rate limiting.Feature request108-09 → 08-09+0%
A security issue was reported publicly but should have been reported privately per the SECURITY.md file.Pain point608-08 → 08-08+500%
MCP plugin generates an ephemeral HMAC key per token request, making ID tokens unverifiable by clients.Bug308-06 → 08-08+200%
Identify retry sleeps in better-auth hardcode exponential backoff with high maxDelay, causing slow auth middleware even with tight kvTimeout configuration.Pain point108-08 → 08-08+0%
Better Auth logs a warning about PostgreSQL int8 type mismatch even though the column was correctly created by the framework.Bug108-08 → 08-08+0%
The MCP plugin metadata advertises a jwks_uri endpoint that does not exist, causing OIDC clients to receive 404 errors.Bug108-08 → 08-08+0%
An authenticated user with no apparent capabilities can enumerate the entire memberbase by calling the /organization/list-members endpoint.Bug108-08 → 08-08+0%
An issue has been blocking a team for months.Pain point108-08 → 08-08+0%
PKCE validation is bypassed when requirePKCE is undefined because the token endpoint skips hash comparison on undefined codeChallenge.Bug208-07 → 08-07+100%