9 ms·
Better Auth, by a self-taught Ethiopian dev, raises $5M from Peak XV, YC
- dang 1y agoRelated: Launch HN: Better Auth (YC X25) – Authentication Framework for TypeScript - https://news.ycombinator.com/item?id=44030492 https://news.ycombinator.com/item?id=44030492 - May 2025 (106 comments) Better Auth – Authentication library for TypeScript - https://news.ycombinator.com/item?id=42272707 https://news.ycombinator.com/item?id=42272707 - Nov 2024 (32 comments) Show HN: Comprehensive authentication library for TypeScript - https://news.ycombinator.com/item?id=41678652 https://news.ycombinator.com/item?id=41678652 - Sept 2024 (44 comments)
- savrajsingh 1y agoclickpass, YC s07
- blackhaj7 1y agoSo pumped for Bereket. Better Auth is awesome. I am also interested on how they plan to monetise it. I love the library and the success story but hope that the weight of this VC money doesn’t impact its awesomeness
- burgerzzz 1y agoI think they’re rolling out their own managed auth service, may have already done so actually.
- TimReynolds 1y agoThey launched this a few months ago
- gus_massa 1y agoWhat is the plan if Amazon decides to launch it as a service?
- vlucas 1y agoAmazon already has Cognito. It's garbage. https://aws.amazon.com/cognito/ https://aws.amazon.com/cognito/
- infecto 1y agoNot great but also far from garage for something that is extremely low cost.
- mooreds 1y agoI mean, it depends on your use case (and I say this as a cognito competitor). There are times when Cognito makes a ton of sense (I wrote about some of them here[0]). There are other times when it doesn't. What I keep wondering and asking is "why doesn't AWS invest more in Cognito?"[1] 0: https://fusionauth.io/blog/how-to-migrate-from-cognito#when-you-shouldnt-migrate https://fusionauth.io/blog/how-to-migrate-from-cognito#when-... 1: https://ciamweekly.substack.com/p/trends-in-ciam https://ciamweekly.substack.com/p/trends-in-ciam
- m3kw9 1y agoGonna use n8n model, have these one click deploys with cloud db and everything or self host for free with many cut off features.
- shafyy 1y ago> I love the library and the success story but hope that the weight of this VC money doesn’t impact its awesomeness It most certainly will at some point.
- yewenjie 1y agoCan anyone compare Better Auth with something more barebones like Lucia?
- threatofrain 1y agoLucia has been converted into a kind of tutorial, which is another way of saying the author is going to college now and is busy or interested in other things. As an aside OpenAuth seems dead. No activity for 2 months.
- apgwoz 1y agoNo activity for 2 months implies death? Is this the core reason that we have a proliferation of packages, arguably doing the same thing, slightly differently, in some ecosystems… We’ve become this impatient?
- FireBeyond 1y agoNo activity for nearly 3 months with 67 open issues, 32 open PRs (many as simple as "fix typo") might signify that not a lot of time is being put into the project.
- vivzkestrel 1y agono lucia author has himself said that he s deprecating this https://github.com/lucia-auth/lucia/discussions/1707 https://github.com/lucia-auth/lucia/discussions/1707
- qreerq 1y ago[dead]
- Capricorn2481 1y agoThey're talking about Open Auth. https://github.com/toolbeam/openauth https://github.com/toolbeam/openauth
- haneul 1y agoLove this news! Amazing by Bereket!
- abetancort 1y ago[flagged]
- reactordev 1y agoHe just raised enough for a golden ticket
- yodon 1y agoPretty sure auth is not something I want a self-taught dev (or even most CS-graduate devs) writing. Oauth2, JWT's, hashes, timestamps, validations, and such, are all totally simple until they're not. The black hats have way more experience and way more time invested in this space than most any normal dev.
- vmg12 1y agoAuth is really not difficult to write. It's don't roll your own crypto, not don't roll your own auth. People need to stop spreading this fud.
- risyachka 1y agoYeah it’s not difficult if you know all the specs. The issue is 99% don’t know them and are not very good at following them. And the cost of error is very high. I’ve seen a lot of startups that failed to implement even google oauth securely. So yeah it’s a far cry from fud and you really should not do it unless you are actually good.
- threatofrain 1y agoBut given that BetterAuth is an open source project with a large following, and also given that they just got funding so they can hire more help, now we can evaluate BetterAuth's competency in terms of their ability to coordinate help.
- kylecazar 1y agoAlso, as far as I know, they aren't reimplementing the core auth libraries/specs mentioned
- fmbb 1y agoOAuth is very complicated and fuzzy though. I am not surprised anyone makes mistakes trying to integrate it anywhere.
- 1y ago
- exiguus 1y agoIf i get it correctly, it solves the problem, to store data on MVP/Prototype Auth providers like Superbase, Auth0 or Firebase. How does it compare to something mature like keycloak? And what is the difference to just self-host superbase?
- Spivak 1y agoThe killer feature is that it's embeddable into your app. You don't have to host anything besides your app and your app's database. I can't understand why people who aren't Google scale do it any other way. When you're at the point where you need a separate auth service I'd call that good problems to have.
- koakuma-chan 1y ago> The killer feature is that it's embeddable into your app. You don't have to host anything besides your app and your app's database. That's why they're gonna monetize by building a cloud service?
- Spivak 1y agoI mean right now it's JS's devise. There's always time in the future for them to ruin it.
- uh_uh 1y agoDoes it also embed two-factor authentication, confirmation/reset emails for me? Those are the reasons one might want to go with Firebase.
- trollbridge 1y agoAnother reason to use Firebase is because they can provide a lot the advanced security (e.g. blacklists for 2FA phone numbers/emails coming from an algorthm whose innards are only known to Google).
- notpushkin 1y ago
- sebmellen 1y agoCurious how this compares to something like Ory Kratos? And what would the projected revenue stream be?
- trollbridge 1y agoKratos and Better Auth are almost orthogonal to one another. Kratos provides a comprehensive back end, but no front end at all - you have to write it yourself. Better Auth is mostly focused on the front end. You could use the two together, although I haven't seen anyone do that. I have wasted so much time on third-party authentication frameworks like Ory Kratos that I wish we'd just written our own internal auth library. With Kratos we ended up customising it so heavily we could have just written our own. Same goes for ones that provided a frontend such as Keycloak.
- koakuma-chan 1y ago> Better Auth is mostly focused on the front end. Better Auth has nothing to do with front end.
- mooreds 1y ago> And what would the projected revenue stream be? I addressed that here, straight from the article. Basically open-core and hosting. https://news.ycombinator.com/item?id=44388741 https://news.ycombinator.com/item?id=44388741
- alephnerd 1y agoGlad to hear Peak XV getting it's moment on a competitor's forum. Jokes aside, congrats Bereket.
- fakedang 1y agoHow does Peak XV compete with YC? Isn't YC just more proof for Peak XV? One could argue it competes with Surge or something, but YC is technically even more early stage than Surge.
- alephnerd 1y agoIt's a tongue in cheek reference to Surge. Most APAC and EMEA founders treat Surge and YC as comparable, simply because YC's offer is comparable to a Series A round in those markets.
- arend321 1y agoWill this be monetized with the classic SSO enterprise subscription play? Would be nice if they are transparent on how they plan to make money. The DX is quite nice, even though not well suited for existing projects as it is hard to migrate existing users. There is no easy way to keep existing sessions or do a legacy login, then migrate a user to the new better-auth supplied hashing function.
- koakuma-chan 1y agoWhy does a JavaScript auth library have to raise five million?
- joshdavham 1y agoBecause the author of this library is an ambitious startup founder and would like to grow his tool into a business.
- cies 1y agoAnd many have done this before (selling auth). 0auth, Clerk, Supabase, etc. Any more I'm missing?
- input_sh 1y agoThat this is not an oauth backend but a frontend library that you hook into something.
- hliyan 1y agoThat doesn't sound right. The initialisation code has a database connection string argument. YOu wouldn't do that from a frontend.
- koakuma-chan 1y agoThis library just hashes passwords and handles oauth2 callbacks. But it also requires a database to "store user data", which is really out of scope of an auth library. But I would like to hear how one goes from a country I've never heard about before to raising 5 mil as a JavaScript library "startup".
- devjab 1y ago> from a country I've never heard about before How is your lack of geographical knowledge relevant to any of this?
- hijinks 1y agocant wait.. i guess on the 27th they are dropping support for SAML
- dancerofaran 1y agohelllll ya! one of the best libraries in the ecosystem. it's basically open-source Clerk without the baggage of needing to trust someone else's security story
- jtms 1y ago"Better Auth’s pitch is simple: Let developers implement everything from simple authentication flows to enterprise-grade systems directly on their databases and embed it all on the back end." Its absolutely bonkers to me that web development has gotten to a point where this is a novel pitch. Up until not that long ago ALL auth was done directly in your own database and embeded in your own backend. Am I missing something?
- rafram 1y agoYeah and it was terrible. Your password would be stored as an unsalted MD5 hash if you were lucky. Enterprise customers did the math on what a security breach lawsuit could cost and started demanding verifiably decent security, which meant some off-the-shelf off-premises solution. That’s basically where we are now, and it’s the reason that most of Better Auth’s users are early-stage startups — they need to scale quickly, and they don’t have many pesky enterprise/governmental customers who might want to see a certification.
- echelon 1y ago> Yeah and it was terrible. Your password would be stored as an unsalted MD5 hash if you were lucky. That's so 2001. Bcrypt was in the default PHP libraries in 2013. It's been available in Python even longer. This pattern of outsourcing the most basic of application responsibilities is lazy and exposes you to needless fragility and cost burdens. There are a million and one libraries and frameworks that will handle all of this for you, meeting industry standards, without having to pay to be coupled at the hip to some SaaS vendor that will undoubtedly raise prices on you when they hit growth pains. You're being rented a partial solution to something that has long been solved. And this - your customer relationship - is such a core function to your business that you shouldn't outsource it.
- socketcluster 1y agoThis is a nice set of tools. Very useful. I hope they will also develop a self-hosted standalone service/node which hosts accounts and can support JWTs which I could verify on my own servers so the BetterAuth node would issue JWTs signed with a secret key I provided as an ENV var, then I could verify the JWTs on my own servers. This would be a neat decoupling. Could be offered as a SaaS service as well. I'm also keeping tabs on https://github.com/stack-auth/stack-auth https://github.com/stack-auth/stack-auth
- mooreds 1y agoI'm in the auth space. It's usually best to verify JWTs using an asymmetric keypair, that way the BetterAuth node can sign the JWT, and your servers can use something like JWKS to get the public key. Lessens where the secret key needs to be. The exception is if: * you control all the nodes and are confident in the security of all of them now and going forward AND * speed is critical (using HMAC to sign JWTs is faster) AND * you've benchmarked and signing speed is a significant portion of response time
- mooreds 1y ago* you control all the nodes and are confident in the security of all of them now and going forward AND * speed is critical (using HMAC to sign/verify JWTs is faster) AND * you've benchmarked and signing speed is a significant portion of response time
- b0a04gl 1y agosupertokens did the same thing from bengaluru. didn’t start loud. just showed up with clean abstractions that didn’t leak. you could tell someone had wrestled with real auth mess before touching a single line. it worked, across teams, stacks, workflows better auth gives off the same shape. that gets well adopted because it survives scaling without needing a rewrite same pattern and diff origin place. someone holding the whole stack in their head long enough to ship something
- lukeh 1y agoI like that last sentence!
- 5Qn8mNbc2FNCiVV 1y agoToo bad that the Supertokens docs became an absolute dumpster fire with their "recipes" and reading the source made me lose confidence in the product's quality to rely on. Not saying better-auth is strictly better, but at least you can read the docs and know what you're getting into yourself instead of 12 variations of the same thing
- rubenvanwyk 1y agoAlso weary now of the monetisation strategy, as this probably means that enterprise SSO will be locked behind a massive paywall?
- seivan 1y agoWhat’s the monetisation strategy here? Raising 5M for what exactly?
- chrisldgk 1y agoAt our company we use better auth for every product that has any kind of user account logic. It’s great since it’s drop-in, the plugins give so much functionality that you’d have to roll on your own in so little time and the integrations with ORMs like drizzle and prisma mean that your schemas stay the SSOT that they should be, even for auth. It’s extensible where it needs to be and brings defaults that are more than sane. Also the RPC-like TypeScript client that you also get for free is so good I don’t know how I could live without that. Glazing over, I just wanted to give props and say that whatever good happens to better-auth, it deserves it.
- h1fra 1y agoCongrats, very good library. I wonder what's going to be the business model though, since the library main difference is that it's not a cloud service
- mooreds 1y agoFrom the article: > Engida says Better Auth, currently free to use, will focus on improving its core features and launch a paid enterprise infrastructure that plugs into its open source base. This will give developers the flexibility to self-host or opt for Better Auth’s cloud add-ons as needed. So open-core and cloud hosting, it seems.
- Imustaskforhelp 1y agoI remember how basically better auth got a huge lead because lucia was shutdown by its dev for their own reasons which I admittedly have forgotten but they made sense and the community had accepted it. But those who hadn't started using better auth more. And now I guess its crazy how I felt as if this would be just a small project like lucia in the sense of its just created for the passion and the art, but now it has raised 5 mill$ , I wonder if the community wanted this to be an artisanal like project like lucia before its end or what the community thinks of this move. Since VC and open source have some inherent compromises with each other and I guess I just wanted to write this to hear more about people who are using better auth in prod and what they think of what this VC funding.
- chrisldgk 1y agoAs an indie hacker using better auth, I’m somewhat skeptical of there now being VC money in the mix (enshittifcation is a process that starts with VC money). But from my time working for enterprise, they often prefer OSS products that are well-funded for their stacks so they can rely on them for a longer amount of time. So I’d suppose this would help in that regard. Also having a cloak-like SaaS solution might be nice for those who don’t want to host their own infra, though I‘d advise against relying on third parties for auth.
- Imustaskforhelp 1y agoThanks for your comment! You really nailed as to what sort of discussion I wanted I guess. I agree so much with the enshittifcation but like, I never understand why atleast open source projects need VC funding/ if they really want to earn money, might as well bootstrap it and try to get some Business customers for support etc. But if you are saying that to get business customers, I need vc funding, then I guess it forces some enshittifcation. I am okay with having a SaaS solution but what I truly don't understand is why we need vc funding. I truly love developers wanting to earn money with open source. I appreciate them because they are essentially giving us gifts and being altruistic and I want to live in a world where people who can, do support them. But I am not okay with is some corporation now deciding the direction to go for open source (and that corporation doesn't care about the craft or the community, they want money.. they want returns since its just a number to them really) and that force of direction really alienates communities and just forks appear and just tbh it becomes messy. I am more than curious as to why enterprises want VC funded OSS products. Yes you rely on them for a longer amount of time, but it also increases the chances of rugpull quite significantly imo. I don't think that one should just get VC funding just because entreprises like it. Should they? Maybe I am so alienated with startup culture but I just want anything I build to not burn piles of cash that I need to rely on someone else, and I'd rather be profitable from (day one?) with my own bootstraped company / basically being a indie hacker like you I suppose. I get why some companies need VC funding and they become startups but I don't think that literally everything should be startup I am not sure.
- voidmain0001 1y agoWhy does the article’s title state the country of origin of the developer? Does it matter? Is it a surprise that there are smart, business savvy developers across the globe?
- revskill 1y agoBecause it is an inyeresting fact.
- ericyd 1y agoIt isn't a surprise for many, but my impression is that distribution of VC funds to African counties is highly inequitable. The article mentions that this is the first investment in an African founder for one of the involved VCs (Peak VX).
- zeroq 1y agoI'm not sold on Better Auth. Recently I wanted to add auth to my pet project, and between (a) using better-auth, then integrating 3rd party mailer service, and rolling out my main dashboard (b) leeching off free tier of Auth0 or Clerk and getting all batteries included I've chose the latter. The fact that better-auth doesn't come with barebone dashboard is criminal. For pet project it doesn't matter if I have to integrate Resend or Clerk, it's still some mental overhead I have to account for, but with Clerk at least I don't have to manage my users using sql queries. People say it's better because you can embed it in your app. I don't buy that either. If I'd have to rollout better-auth I'd do that as a separate app, just to encapsulate database, dashboard, and integrations. Anyway, glad it's getting traction, I just don't get all the hype around it.
- notpushkin 1y agoIf Better Auth came with a simple builtin email implementation (i.e. just plug in SMTP credentials), I’d consider it perfect. (I’m not sold on Resend!) Agreed that a builtin dashboard would be nice, but it’s not necessary by any means – you’ll still be building your own dashboard around your ORM models, which is of course what Better Auth uses, too. But if you’re looking for something more like Clerk, maybe try Logto or Authentik?
- zeroq 1y agoAfter your post I made it back to logto to see that I've already have account in their system. Then I looked around and I still have no clue what their offering is about. Seriously, it's so "AI", "MCP", "SaaS" oriented that I'm absolutely clueless what the offering is.
- whatevsmate 1y ago> is criminal No, it isn’t. Take a breath.
- ARandomerDude 1y agoThe parent was using something called “figurative speech”. https://en.m.wikipedia.org/wiki/Figure_of_speech https://en.m.wikipedia.org/wiki/Figure_of_speech
- briandear 1y agoAren’t we all self taught? I’m not sure why that part of the story is relevant. In over 15 years of this business, I’ve directly been on a team with probably 5-10 total people with a comp-sci degree — and that includes my time at Apple. Mark Zuckerberg was self-taught.
- bapak 1y agoNo, a lot of people go to college or "bootcamps" before entering the field. Given the amount of computer science graduates, I'd say we're not all self-taught.
- nickzelei 1y agoFor folks that are using better-auth: are you using anything to build your frontend with? Or just writing it from scratch? I was interested in trying this out but was kinda surprised to find this is just an sdk with no components. I found this https://better-auth-ui.com/ https://better-auth-ui.com/
- abc123abc123 1y agoWonderfully racist! How is it relevant in any way that the dev is ethiopian? I couldn't care less. I care about the product or service.
- mtlmtlmtlmtl 1y agoIf you don't care, why is it the only thing about this news that you're engaging with in your comment?
- neom 1y agoEthiopia is a nation. The word you're looking for is Nationalistic.
- erikpukinskis 1y agoEthiopia isn’t a race though? Are you saying you believe the title was trying to signal that the founder is black, not their country of origin? I’m not sure you can draw that conclusion.
- J4DsJtgs 1y agoplease. the whole world sees this for what it is: the USian bigotry of low expectations.
- geodel 1y agoYeah, this cool "I don't care" attitude works only until one is on winning side of economy. Once its not then it is always bias against them on basis color, age, nationality, race and so on.
- govindsb 1y agoBetter Auth is brilliant! My only criticism is that it's too tightly coupled with Kysely.
- 1oooqooq 1y agoyet another jswt solution for no good reason other than js based "backends" can't really handle requests properly.
- arnavsahu336 1y agoThis is Arnav Sahu from PeakXV. I used to work at YC. Really excited for them and Bereket, the founder. He is an outlier founder.
- HPMOR 1y agoWhat is your personal framework for determining if a founder is an outlier or not? Given how many people you've seen go through YC, and chatting with most of the batch, what stands out to you?
- arvindparekh 1y agoThis is awesome! I literally gave better-auth a spin 2 days ago and I was able to get it up and running within 15 minutes. I'm yet to try the plugins, but looks really easy to set up and work with, safe to say I'll be using it for future projects. I didn't like the fact that it doesn't have a built-in sign-in ui components, but glady https://github.com/daveyplate/better-auth-ui https://github.com/daveyplate/better-auth-ui solves it.
- TrySound 1y agoJust tried to setup auth with it recently. And oh boy, so refreshing. Built auth once for a project years ago. Never again. Here just configured stuff, setup email and social creds and live!