#WorkOS vs Better Auth current state

1 messages · Page 1 of 1 (latest)

tulip salmon
#

What is the current state of WorkOS and Better Auth integrations? Trying to decide which is best to use, especially with flexibility to start off as B2C and switch to B2B. I know there are Convex components for each, but I want to know if there is anything specific Better Auth cannot do for most B2B and B2C use cases.

bold capeBOT
#

Hi @tulip salmon. I'm kapa.ai, your friendly support bot. I will try to answer your question by searching through the knowledge base. :wave:

#

Based on the sources, both WorkOS and Better Auth are viable with Convex today, but they’re at different maturity levels and target slightly different sweet spots.

WorkOS + Convex (AuthKit)

What exists now

  • WorkOS is an officially documented third‑party auth option in Convex’s main auth docs, alongside Clerk and Auth0. [Auth overview]
  • There is an official Convex component for WorkOS AuthKit: @convex-dev/workos-authkit. It:
    • Integrates with WorkOS AuthKit for authentication.
    • Syncs user data from WorkOS into Convex via webhooks.
    • Exposes helpers like authKit.getAuthUser(ctx) in Convex functions. [WorkOS component]
  • The guide for WorkOS AuthKit is now linked from the Convex docs and is considered the “official way” to integrate WorkOS with Convex. [WorkOS component]

Current caveats / state

#
  • Earlier Discord threads show there were issues around:
    • JWT issuer mismatch and JWK content types when using WorkOS via Custom Auth; Convex added support for the WorkOS JWK content type and that specific blocker is reported as resolved. [WorkOS custom auth thread; WorkOS custom auth earlier]
    • Token refresh causing brief “unauthenticated” blips and redirect loops; there are workarounds (e.g., guarding on accessToken in loading state) and the Convex + WorkOS team has been iterating on this. [WorkOS authkit thread]
  • Trusted staff say WorkOS “is working well now” and is actively being refined. [WorkOS authkit thread]

Fit for B2B vs B2C

  • Convex’s own docs explicitly position WorkOS AuthKit as “built for B2B apps and free for up to 1M users.” [Auth overview; WorkOS component]
  • WorkOS itself is oriented around SSO, organizations, enterprise features, etc., which is a strong fit for B2B. For pure B2C it still works, but you may be paying for/working around enterprise‑centric concepts.

Better Auth + Convex

What exists now

#
  • There is an official Convex component for Better Auth: get-convex/better-auth. [Better Auth component]
  • Convex has dedicated docs at labs.convex.dev/better-auth that:
  • Better Auth is described as a good option if you “want to keep everything in your Convex DB” and still have cross‑subdomain login, which is relevant for multi‑tenant / multi‑subdomain B2B setups. [Multi‑tenant auth thread]

Supported vs unsupported features

From the supported‑plugins list for Convex + Better Auth: [Supported plugins]

  • Supported (no schema changes needed):

    • Email/password (core Better Auth)
    • Anonymous
    • Email OTP
    • Generic OAuth (social providers)
    • JWT
    • Magic Link
    • One Tap
    • Passkey
    • Phone Number
    • Two Factor (2FA)
    • Username

  • Explicitly incompatible with Convex + Better Auth:

    • SSO plugin – “has direct dependencies on Node.js” and is listed as incompatible even with Local Install. [Supported plugins]

So for B2C and “standard SaaS” auth (email/password, social login, OTP, passkeys, 2FA, etc.), Better Auth + Convex is well‑covered.

For B2B SSO / enterprise:

#
  • The knowledge sources explicitly say the Better Auth SSO plugin is incompatible with Convex. [Supported plugins]
  • That means if your B2B roadmap includes SAML/enterprise SSO via Better Auth’s SSO plugin, that specific path is not supported with Convex today.

There is also a “local install” mode for Better Auth that can generate schemas and support more plugins, but the docs only say that’s how you’d handle plugins that require schema changes; they do not say this makes SSO compatible, and SSO is still listed as incompatible even with Local Install. [Supported plugins]

Maturity / stability

  • Better Auth integration is described as alpha/early in Discord, with some users reporting rough edges (e.g., org/admin performance, some breaking changes expected). [Convex Auth vs Better Auth thread]
  • Convex staff also say active development focus is currently on the Better Auth integration, and it’s likely to become a “new standard” over time, but it’s still earlier than Convex Auth and has breaking changes coming. [Convex Auth reliability thread]

Direct comparison for your scenario (B2C now, B2B later)

From the sources, the key functional gap is:

#
  • Better Auth + Convex cannot currently use Better Auth’s SSO plugin, which is central to many B2B/enterprise SSO scenarios. [Supported plugins]
  • WorkOS + Convex is explicitly positioned for B2B, with official docs and a Convex component, and WorkOS itself is an enterprise‑oriented platform. [Auth overview; WorkOS component]

So, in terms of flexibility:

  • If you know you’ll want robust B2B SSO (Okta, Azure AD, etc.) and org‑level features:
    • The knowledge strongly favors WorkOS AuthKit + Convex as the more “ready” path for B2B.
  • If you’re primarily B2C now and want:
    • Everything stored in Convex,
    • Rich credential options (email/password, OTP, magic links, passkeys, 2FA, social),
    • And you’re okay with not having Better Auth’s SSO plugin on Convex,
    • Then Better Auth + Convex is a good fit and officially supported for those plugins. [Better Auth component; Supported plugins]

The sources do not describe a complete, official “start B2C on Better Auth and later add B2B SSO” story; for SSO specifically, WorkOS (or another third‑party provider like Clerk/Auth0) is what Convex’s docs and staff point to today. [Auth overview; Multi‑tenant auth thread]

Summary

#
  • Better Auth + Convex: Great for B2C and many SaaS use cases (email/password, social, OTP, passkeys, 2FA, etc.), keeps auth data in Convex, but cannot use Better Auth’s SSO plugin with Convex right now.
  • WorkOS + Convex: Officially documented, actively supported, and explicitly targeted at B2B (SSO, orgs, enterprise). Some integration details have been evolving, but staff say it’s working well now.

If your long‑term plan includes serious B2B SSO, the knowledge sources point more clearly toward WorkOS as the safer bet for that part of the roadmap.

Note: you can ask me a follow up question by @ mentioning me again :speech_balloon:

#

@tulip salmon Kapa.ai is still learning and improving, please let me know how I did by reacting below.

tulip salmon
#

@bold cape Is there any update on current state of workos vs better auth?

bold capeBOT
#

Let me check the knowledge base for you again. One moment! :books:

#

There isn’t any newer comparison between WorkOS and Better Auth in the provided sources beyond what you already saw; I’ll summarize the current documented state as it appears there.

WorkOS + Convex

  • Convex has an official WorkOS AuthKit integration:
    • Component: @convex-dev/workos-authkit.
    • Features: sync WorkOS users into Convex via webhooks and expose helpers like authKit.getAuthUser(ctx) in Convex functions. [WorkOS component]
  • WorkOS is now explicitly mentioned in the Convex auth docs with a dedicated guide. [WorkOS component]
  • Earlier issues (issuer mismatch, JWKS content type, token refresh blips) have been iterated on; staff say WorkOS “is working well now,” and the remaining known issue in the template is around logout after a failed fetch. [WorkOS authkit thread]
  • Positioning: WorkOS is still framed as the B2B‑oriented option (SSO, orgs, enterprise). [WorkOS component]

Better Auth + Convex

#
  • Convex has an official Better Auth integration with its own docs at labs.convex.dev/better-auth. [Supported plugins]
  • Supported plugins with Convex (no extra schema work): Anonymous, Email OTP, Generic OAuth, JWT, Magic Link, One Tap, Passkey, Phone Number, 2FA, Username, etc. [Supported plugins]
  • Explicitly incompatible: the Better Auth SSO plugin, even with Local Install, due to Node.js dependencies. [Supported plugins]
  • In Discord, Convex staff describe the Better Auth integration as still in alpha/early and under active development, with some breaking changes expected. [Supported plugins]

Net effect (as of these sources)

  • For B2C and “standard SaaS” (email/password, social login, OTP, passkeys, 2FA, etc.), Better Auth + Convex is well supported.
  • For B2B SSO / enterprise, the Better Auth SSO plugin remains incompatible with Convex, while WorkOS + Convex is the documented path and is being actively refined. [WorkOS component; Supported plugins]

The knowledge sources do not show any newer change that would, for example, make Better Auth’s SSO plugin compatible with Convex or deprecate the WorkOS integration.

Note: you can ask me a follow up question by @ mentioning me again :speech_balloon:

#

@tulip salmon Kapa.ai is still learning and improving, please let me know how I did by reacting below.

tulip salmon
#

@bold cape So it's not possible to do B2B with Convex and Better Auth? When I say B2B I don't mean using SSO but just setting up organizations with multiple users, etc. Multitenancy basically.

bold capeBOT
#

Let me check the knowledge base for you again. One moment! :books:

#

It is possible to do B2B-style multitenancy with Convex + Better Auth, but there are some important limits and nuances.

1. What is supported today

Better Auth + Convex supports all the core pieces you’d typically need for B2B-style apps without SSO:

  • Standard auth flows (email/password, OTP, magic links, social via Generic OAuth, passkeys, 2FA, etc.). [Supported plugins]
  • You can build your own multi-tenant / organization model in your own Convex tables, and just use Better Auth for user identity + sessions. Convex itself is fully capable of multi-tenant data modeling; staff explicitly say multi-tenant is not harder in Convex. [Is Convex good]

In other words: you can absolutely have “organizations with multiple users” and tenant scoping in Convex while using Better Auth for authentication.

2. Better Auth’s own “organization” plugin

There is an official Better Auth organization plugin, but:

#
  • Only a subset of Better Auth plugins are “supported out of the box” with Convex. [Supported plugins]
  • For plugins that require schema changes and aren’t in that list, Convex’s docs say you must use Local Install to own the Better Auth schema and support additional plugins. [Local install; Supported plugins]
  • A Discord thread shows someone trying to use the organization plugin directly with the default component and hitting runtime errors; staff responded that “out of the box only the supported plugins work” and to use Local Install for other plugins. [Org plugin issue]

So:

  • Using Better Auth’s organization plugin with Convex requires the Local Install flow and schema generation.
  • The docs do not give a full, step‑by‑step example of orgs on Convex, but they do say Local Install is the path for plugins beyond the supported list. [Local install]

3. What is not supported

The main thing you cannot do with Convex + Better Auth today is:

  • Use the Better Auth SSO plugin (SAML/enterprise SSO) – it’s explicitly listed as incompatible with Convex, even with Local Install, due to Node.js dependencies. [Supported plugins]

That’s the big gap for “enterprise B2B with SSO,” not for basic multitenant orgs.

4. Practical takeaway

#
  • Yes, you can do B2B-style multitenancy (organizations, multiple users per org, role-based access, etc.) with Convex + Better Auth:
    • Either by modeling orgs/tenants yourself in Convex tables and just using Better Auth for auth, or
    • By using Better Auth’s organization plugin via Local Install (more setup, not “out of the box”).
  • No, you currently cannot use Better Auth’s SSO plugin with Convex, so if your B2B roadmap includes SAML/enterprise SSO, you’d need something like WorkOS for that part. [Supported plugins]

Note: you can ask me a follow up question by @ mentioning me again :speech_balloon:

#

@tulip salmon Kapa.ai is still learning and improving, please let me know how I did by reacting below.

tulip salmon
#

@bold cape Have there been any discord user discussions about multitenancy in better auth with convex

bold capeBOT
#

Let me check the knowledge base for you again. One moment! :books:

#

There is a little bit of relevant discussion, but not much that goes deep into multitenancy patterns.

From the provided sources:

  • One user explicitly asked about using the Better Auth organization plugin with Convex (for multi‑company / multi‑tenant support). They were seeing runtime errors when calling listOrganizations / createOrganization. Staff replied that, “out of the box only the supported plugins work,” and that to use plugins like organization you need to switch to the Local Install flow for Better Auth on Convex. [Org plugin issue; Local install; Supported plugins]

  • Another thread is about a B2B Next.js app using Convex + Better Auth, asking how to handle user & organization schemas and whether to use Better Auth’s organization tables vs custom tables. The answer in the snippet just points to an “upcoming release” that would help, without further detail in the provided context. [Using BetterAuth B2B]

  • In a separate multi‑tenant discussion, staff mention Better Auth as an option that supports cross‑subdomain login and “keeping everything in your Convex DB,” but that thread doesn’t go into concrete multitenant schema design with Better Auth. [Is Convex good]

#

Beyond these, the knowledge sources don’t show more detailed Discord conversations specifically about multitenancy patterns with Better Auth + Convex (e.g., full org/tenant examples, best practices, or long design discussions).

Note: you can ask me a follow up question by @ mentioning me again :speech_balloon: