Better Auth or Cognito?

The short version

Cognito: the easy pick for small apps

I build a lot of small internal apps and admin panels for corporate clients. They stay well under 10,000 monthly users, so Cognito is free, and everything is configured rather than built: the hosted login page, sign-up, forgot password, Google or Microsoft sign-in, MFA. For those, it's the fastest path and there's nothing to maintain.

Its weak spots matter more as an app grows:

• Two user stores. Users live in Cognito and in your database, kept in sync by triggers. I don't like that.
• Missing features: no organisations, no magic links, no SCIM.
• Triggers get 5 seconds, not adjustable.
• The built-in email sender stops at 50 emails a day per AWS account: point it at SES before launch.

Better Auth: the first pick for serious apps on Postgres

When the app is meant to grow and its data is in Postgres, Better Auth wins:

• One user store. Users, sessions and organisations are tables in your Neon or Aurora database, next to the rest of the data.
• Free forever. No per-user fee; you already pay for the database.
• More features than Cognito (table above).
• Data residency for free. Users sit wherever your database is: Sydney, if that's where it is.

What works out of the box

Email and password with password reset, email verification, sign-in with Google, Microsoft, GitHub and many more, sessions, passkeys, MFA, magic links, organisations with roles, enterprise SSO and SCIM. Each is a few lines of config, and its CLI creates the tables.

import { betterAuth } from 'better-auth'
import { Pool } from 'pg'
import { Resend } from 'resend'

const resend = new Resend(process.env.RESEND_API_KEY)

export const auth = betterAuth({
	database: new Pool({ connectionString: process.env.DATABASE_URL }), // Neon pooled URL
	emailAndPassword: {
		enabled: true,
		sendResetPassword: async ({ user, url }) => {
			await resend.emails.send({ from: 'app@example.com', to: user.email, subject: 'Reset your password', html: `<a href="${url}">Reset it</a>` })
		},
	},
	socialProviders: {
		google: { clientId: process.env.GOOGLE_ID, clientSecret: process.env.GOOGLE_SECRET },
		microsoft: { clientId: process.env.MS_ID, clientSecret: process.env.MS_SECRET },
		github: { clientId: process.env.GITHUB_ID, clientSecret: process.env.GITHUB_SECRET },
	},
})

You still register your app with Google, Microsoft and GitHub to get those keys, exactly as with Cognito.

What you build yourself

• The screens: sign-in, sign-up, forgot password. About a day with Claude Code, and they match your design.
• The emails: a few lines each with Resend (reset, verification, magic link).
• The hosting: the auth endpoints run in your backend, for example a Lambda in the client's region. Issue RS256 tokens so Workers, API Gateway and AWS IAM can all verify them.
• The patching: pin versions and update weekly (see below).

Enterprise SSO: what's free and what's paid

This only matters when you sell to big companies whose staff must sign in with their corporate login (Okta, Microsoft Entra). For each such client, someone has to enter that company's login settings into your app.

• Free: everything that makes the login work. You enter a client's settings yourself, in code or through the API, and Better Auth handles SAML, OIDC, domain verification and SCIM.
• Paid, or built by you: a wizard where you email the client's IT admin a link and they set it up themselves. Better Auth Infrastructure sells it at $20 a month with one connection, then $50 a month each, along with an admin dashboard, audit logs and email/SMS sending. Building your own is about a week for SSO and 3–4 weeks with directory sync, plus a day or two a month of upkeep. Worth it once several enterprise clients want it.

Cognito has no such wizard at all, so starting on Better Auth loses nothing.

The honest cost of owning auth

Better Auth had 27 security advisories in 2026, 3 of them critical, many in the young SSO and SCIM plugins. Other open-source auth projects had similar years. So:

• Pin exact versions; let Renovate or Dependabot open the upgrade PRs.
• A weekly scheduled agent checks the repo's security advisories and opens the upgrade.
• Enable only the plugins you use. Register SSO providers only from your server code, require domain verification, and keep implicit account linking off.

Others I looked at

• WorkOS: the best enterprise kit (self-serve SSO portal, SCIM, audit logs), free to 1M users, but $125 per SSO connection and US-hosted only.
• Kinde, or Auth0's Australian region: managed auth with data in Australia.
• Clerk: great for React apps without residency constraints; US-hosted.
• Neon Auth: Better Auth hosted by Neon, users in your Neon database. Not ready yet: no SSO, no MFA, beta SDK. Worth checking every quarter.