From Supabase to Clerk to Better Auth

· security · Source ↗

TLDR

  • Val Town replaced Clerk with Better Auth after years of rate limit footguns, outages, and a forced two-users-table architecture that broke their social platform.

Key Takeaways

  • Clerk’s model assumes users only see their own data; social sites like Val Town need a real users table, forcing a fragile webhook sync and split authority over user state.
  • Clerk’s session refresh path made it a single point of failure: Clerk downtime made the whole site unusable, not just login. Uptime has been near two-nines since May 2025.
  • Better Auth runs entirely in Val Town’s own infrastructure; their paid “Infrastructure” tier is stateless and uninvolved in session management, eliminating the vendor-uptime dependency.
  • A two-week parallel-auth transition (accepting both Clerk and Better Auth cookies simultaneously) let users migrate passively. LLM assistance made the parallel path feasible on a small team.
  • Better Auth’s dashboard works via an API plugin on Val Town’s own domain, so all user data stays in their database.

Hacker News Comment Review

  • Commenters broadly agreed the Clerk model is fine for simple, non-social frontend apps but dangerous when session refresh becomes a dependency on third-party uptime, a risk confirmed by real CloudFlare/Auth0 cascade failures described in replies.
  • The library-vs-service distinction dominated discussion: Better Auth as a library means no external availability dependency, while any auth-as-a-service (Clerk, Auth0, WorkOS) multiplies your outage surface. The math is multiplicative, not additive.
  • Several builders noted they avoided the problem entirely by self-hosting auth with Lucia or rolling minimal custom sessions, arguing the security complexity is overstated and the week of learning pays off long-term.

Notable Comments

  • @bekacru: Better Auth’s founder confirms the project started to solve this exact problem personally before becoming a company.
  • @gordonhart: Concrete cascade failure example: a CloudFlare outage bricked an app for hours because Auth0 public keys for JWT verification were served behind CloudFlare.

Original | Discuss on HN