Vercel acquired the open-source auth library built to replace the one it already owned

The library built to unseat NextAuth now belongs to NextAuth's owner

Better Auth is an open-source, framework-agnostic authentication library for TypeScript, and the tool a lot of developers reached for precisely because they wanted an alternative to Vercel's own NextAuth/Auth.js. Founder Bereket Engida shipped the first release on September 28, 2024, took it through Y Combinator and a Peak XV–led round with 50-plus angels, and less than two years later wrote the post announcing the project is joining Vercel.

His framing is relief, not sale. Joining Vercel, he writes, lets the team stop "shaping the strategy around monetization" and refocus on the original mission — helping developers own their auth. The load-bearing promise: "Vercel shares our commitment to keeping auth open source, framework and platform agnostic." The roadmap adds an "Agent Auth Protocol" for agent-based security workflows, built on Vercel's infrastructure.

One detail the post doesn't dwell on: Vercel already owns NextAuth (now Auth.js). With this deal, a single company controls both of the most widely used open-source auth libraries in the JavaScript ecosystem.

The thread read "joining Vercel" as a countdown

The first substantive reply went straight to lock-in. A full-stack web developer asked the question the announcement avoided:

"can Vercel give any assurance that they won't add a reliance on their closed-source cloud offering for the package? especially given their ownership of next-auth too"

He added the saving grace: Better Auth's database adapters make it "relatively easy to switch over to another provider," which is exactly what several people started pricing out.

The mood hardened into a verdict on the whole genre of these deals. A developer who says he opted out of Better Auth for his latest product put it flatly:

"Open source isn't really open any more. It's just pre-acquisition."

Not everyone was mourning. whalesalad, a YC-backed founder waved the whole category away: "Auth is not hard to roll yourself. Crypto: don't do it. Auth? Easy peasy." A run of commenters pointed to Keycloak, donated to the CNCF in 2023, as the vendor-neutral fallback that can't be acquired out from under them.

The sharpest discomfort came from people already in production. A developer who had just wired Better Auth into a new product wrote that it was "time to start looking for backup plans," adding that "everything [Vercel] has done in the last few years turns into a complicated mess." The complaints weren't only about the deal: a developer who used it for a mobile-app backend noted the OpenAPI spec "gets little care, as it mainly caters for JS frontend, and breaking changes in patch version are more common than most packages."

Engida replied in the thread that Vercel had "been my biggest inspiration" and that the deal lets him get "back focusing full time on building." That is the tension in one page: the founder sees a team freed to build, and a chunk of his users see the countdown to the moment when "framework and platform agnostic" is a promise made by the platform they were trying to stay independent of, rather than a property guaranteed against it.