Clerk vs Supabase Auth vs Auth.js: What to Pick in 2026

If your app already uses Supabase for its database, use Supabase Auth. If you want login working in an afternoon with prebuilt sign-in screens, use Clerk. Skip Auth.js for new projects, because it's now in maintenance mode.

That's the short version of clerk vs supabase auth. The rest of this piece covers why, what each costs, and how to get your AI editor to set one up without it improvising a login system.

The quick comparison

Clerk: the "I don't want to build a login page" option

Clerk is a hosted service. You drop in its components, and sign-in, sign-up, sessions and a user dashboard are mostly handled for you. That's a good match for AI editors. The agent has less code to get wrong, because it's mostly gluing components together.

Pricing moved in 2026, and older comparison posts are out of date. Clerk raised its free tier from 10,000 to 50,000 monthly retained users in February 2026. A "retained" user is one who comes back at least one day after signing up. Someone who signs up and never returns isn't billed. Another source lists Pro at $25/mo with $0.02 per MRU past the included 50,000. Confirm on Clerk's own pricing page before you commit, since this has changed more than once.

The trade-off is that your user table lives in Clerk's system, not your database. You'll usually sync a copy of the user ID into your own tables. That's fine, but tell your agent up front.

Supabase Auth: the "my database is already there" option

If your data is already in Supabase, Auth is the path of least resistance. Users land in the same project as your data, and row-level security policies can reference the signed-in user directly. For AI-generated apps, that tight link matters. Policies like "users can only read their own rows" are easy to describe and easy for an agent to write.

Supabase also gives you more room on the free plan. Per its billing docs, Free includes 50,000 MAU, and Pro/Team include 100,000 MAU, then $0.00325 per MAU. Pro itself is $25 a month per organization, and that fee covers the rest of the backend too.

Note that "active" is broad. You're charged for distinct users who sign in or refresh their token during the billing cycle. Each user counts once per cycle.

The trade-off is that the UI is mostly yours to build. Supabase gives you the auth API, not a polished set of drop-in screens. Your agent will write the forms, and you'll review them.

Auth.js: don't start here

Auth.js (the project behind NextAuth.js) used to be the default for Next.js. Then things changed. In September 2025 it came under the maintenance of the Better Auth team. Existing users can keep using it, and the announcement says security patches and urgent issues will keep getting addressed. That's maintenance, not new development.

The same Better Auth blog also lists an Auth.js security update from July 2026 covering four advisories. So it's still being patched. One comparison source also said v5 was still in beta as of September 2026, so check the current state before you rely on that claim.

For a new app, that points two ways. Use Clerk or Supabase Auth if you want a managed option. If you want open-source and self-hosted, look at Better Auth, which the Auth.js team itself recommends for new projects. I haven't tested it here, so treat it as a lead, not a verdict.

How to choose in 60 seconds

1. Already on Supabase for data? Use Supabase Auth. Fewer moving parts.
2. Not on Supabase, and you want the least code? Use Clerk.
3. Need to own your user data or avoid per-user fees? Use Supabase Auth or a self-hosted library. Clerk's per-user pricing is the one to model.
4. Have an existing NextAuth app that works? Leave it alone for now. Plan a migration when you have a quiet week.

One caution on cost. Free tiers of 50,000 users are far more than most side projects will hit. Don't pick your auth provider based on a bill you may never see. Pick the one your agent will wire up with the fewest mistakes.

A prompt you can paste

Agents tend to hand-roll auth if you don't tell them not to. This keeps them on the rails:

Add authentication to this app using [Clerk | Supabase Auth].
Rules:
- Follow the official docs for the framework version in package.json. Don't invent APIs.
- Do NOT write your own password hashing, session, or token code.
- Put all keys in .env.local and add them to .gitignore. Never hardcode secrets.
- Protect these routes: /dashboard and /settings. Public: / and /pricing.
- Store the user ID on every row of user-owned tables.
- First, list the steps I need to do in the provider's dashboard.
- Then make the code changes, then tell me how to test sign-up, sign-in, and sign-out.

If you picked Supabase, add one more line: "Enable row-level security on every table and write a policy so users can only access their own rows." Then check the policies yourself. Agents sometimes leave tables open to make an error go away.

Test before you ship

• Sign up with a fresh email, then sign out and back in.
• Open a protected route in a private window. You should get bounced to sign-in.
• Log in as user A, then try to load user B's data by changing an ID in the URL. It should fail.
• Search the repo for your secret keys. They should only appear in env files.
• Check that your production environment variables are set, not just the local ones.

FAQ

Is Supabase Auth cheaper than Clerk?

Usually, yes, at higher user counts. Supabase includes 100,000 MAU on Pro and charges a fraction of a cent per user after that, while Clerk charges $0.02 per retained user past its included 50,000, per the sources above. At small scale both are free, so it matters little. Compare the current pricing pages before you decide.

Can I use Clerk with a Supabase database?

Probably, since Supabase's pricing lists a separate meter for third-party auth users. But I didn't verify the integration steps for this article. Read both providers' current docs first, and expect to sync user IDs between the two systems.

Should I still use Auth.js for a new project?

I wouldn't. It's in maintenance mode under the Better Auth team, and that team recommends Better Auth for new projects. Existing Auth.js apps can keep running, and security fixes are still shipping.

Cover photo: Towfiqu barbhuiya on Unsplash