The biggest problem with Cognito isn't a missing feature, it's that you end up with two user stores: users in Cognito and users in Postgres, kept in sync by triggers. Better Auth puts them in one place, the database you already pay for, so it's free forever and every user is one JOIN away from their data.
It also does more than Cognito out of the box: email and password with reset, social sign-in (Google, Microsoft, GitHub and more), passkeys, MFA, magic links, organisations with roles, enterprise SSO and SCIM.
The price is ownership: you build the login screens, wire the emails to Resend, host it on a Lambda, and patch it every week. For a serious app on Postgres, that's a trade I'll take.
Use it when
- A serious app on Postgres that you expect to grow: one user table, in the database you already pay for, joined with everything else.
- You need what Cognito doesn't have: organisations and teams, magic links, enterprise SSO without per-user fees, SCIM.
- Data must stay in Australia: users sit wherever your Neon or Aurora database is.
Don't use it when
- A small internal app or admin panel that just needs sign-in working today: Cognito does it with less to build.
- Nobody will patch it: a library you own is a library you update, weekly.
- The client needs an auth vendor's SOC 2 report: a library has none of its own.
Pricing
Free (MIT), with no per-user fee. You pay only for the Lambda and the Postgres you already run. Optional hosted extras (Better Auth Infrastructure): Pro $20 a month with one self-serve SSO connection, then $50 a month per extra connection.
Gotchas, with fixes
Gotcha: There's no hosted login page. Better Auth gives you the endpoints and a client SDK, not the screens.
Fix: Build sign-in, sign-up and reset-password pages in your app (a day with Claude Code), or use a ready-made component kit if the front end is React. They match your design, which Cognito's pages never quite do.
Gotcha: It doesn't send email. Password reset, verification and magic links produce a link and wait for you.
Fix: Pass it to Resend in a few lines (sendResetPassword, sendVerificationEmail, sendMagicLink).
Gotcha: 27 security advisories in 2026 (3 critical), many in the young SSO and SCIM plugins. Other open-source auth projects had similar years.
Fix: Pin exact versions, let Renovate or Dependabot open update PRs, and run a weekly scheduled agent that checks the repo's security advisories and opens the upgrade. Enable only the plugins you use.
Gotcha: Letting users register their own SSO providers caused most of the 2026 SSO advisories (account takeover through unproven domains).
Fix: Register SSO providers only from your own server code, require DNS domain verification, turn on requireTimestamps for SAML, and keep implicit account linking off.
Gotcha: Its JWT plugin signs EdDSA by default, which API Gateway JWT authorizers and IAM don't accept.
Fix: Configure RS256. Then Workers, API Gateway and Cognito identity pools all accept its tokens.
Gotcha: Google Workspace can't push users to custom apps over SCIM.
Fix: Google sign-in works; for Google directory sync, use another tool (Ory Polis or WorkOS) or invite users by domain.
Instead, consider
- Amazon Cognito Small internal apps and admin panels: everything out of the box, free below 10,000 monthly users.
Worked examples
Where it fits
- Sign-in and identity: Pick 01.
First pick for a serious app on Postgres: users in your own database, one store, more features than Cognito, no per-user fee. You build the screens and wire the emails.
Sources
Last reviewed by Nicolas Dao