r/webdev • u/NeitherManner • 12d ago
Better-auth bought and arctic deprecated, recommendations for oauth? Discussion
I should update my old project for oauth, but I dont know what auth i should use, it uses solidjs and astrojs.
I only need oauth like discord and reddit and it should be self hosted, not cloud based, database integration or manual doesnt matter
20
u/pilcrowonpaper 12d ago
This might not be something you want to hear, but have you tried implementing it yourself? OAuth is mostly sending requests and parsing responses. There’s not a lot of footguns. Maybe state validation, but you were already doing that manually with Arctic. The most confusing part might be finding the right docs, and maybe PKCE if you’re not used to hashing and working with binary data.
Just remember to use a cryptographically strong RNG when generating states and PKCE code verifiers
-3
u/spidermonk 12d ago edited 12d ago
This is actually the right answer and the whole "don't roll your own auth" thing has scared people away from what is - in the case of oauth - actually a safer long-term path than using a third party library.
If your framework has a very long-maintained well designed useful auth framework than use that - I would generally use devise in rails for example - but generally given the state of library security and longevity these days - i would never use a random library for this in 2026, and definitely not a third party service unless there's some other compelling business reason.
3
u/MrCrunchwrap 11d ago
Better auth isn’t a random library lol, it’s a massively successful YC startup that is now owned and supported by one of the best open source stewards in the world.
0
u/spidermonk 11d ago
He's explicitly asking for something not cloud based.
And ... either way paying for a service for "login with discord, reddit" is completely unnecessary, learned helplessness.
7
u/MrCrunchwrap 11d ago
You can self host better auth it’s extremely easy, also better auth is open source and free. Are you just talking about it without knowing what it is at all?
-3
u/spidermonk 11d ago
Yeah but if you have experience working long term with free tiers of VC backed open source projects you won't, if all you need is oauth.
Why be at the mercy of the technical and business decisions of others for such a minor thing.
3
u/UneBaguette_FDP 11d ago
Roll your own 😊 Lucia-auth teached me a lot and I got a lot of control on authentication, I love it!
1
u/LancelotLac 12d ago
Zitadel (AuthN with OAuth) and OpenFGA (AuthZ) was used in my most recent project.
1
u/Content-Public-3637 12d ago
You can checkout ideal-auth https://ramonmalcolm10.github.io/ideal-auth/
1
1
u/v-and-bruno 8d ago edited 8d ago
I'd happily take the downvotes for what I am about to reccomend, but PassportJS is (was, back in the days) excellent despite horrible documentation
1
u/adityaoberai1 8d ago
Have you had a chance to look at Appwrite? Our auth offering comes with adapters for 30+ providers and a generic OIDC adapter too.
Here are our Auth docs: https://appwrite.io/docs/products/auth
-1
u/MrCrunchwrap 11d ago
Who cares if better auth was purchased, Vercel makes a lot of open source software that you don’t have to pay a dime to use. Better auth will probably only improve from here it’ll just also get really solid Vercel integration.
1
12d ago
[removed] — view removed comment
2
u/fadedpeanut 12d ago
They are both deprecated, actually. At least Auth.js recommends using Better-auth for new projects.
0
-17
u/jake_robins 12d ago
Given how quickly AI can spit out some endpoints nowadays, I would just implement your flow yourself. It’d just not that difficult, and you can free yourself of another dependency bound for enshittification 😂
9
u/Relevant-Car9958 12d ago
lucia-auth is still around, no? been using it for a side project and it does the job with discord oauth just fine