Session and security boundary
Core binds a managed provider session to the exact local identity and checks that binding on subsequent requests. Disabled mappings, revoked provider sessions, expired local sessions and account restrictions deny access. Accounts with MFA enabled must complete Core’s security step; operators require MFA. Existing MFA enrollment and local IDs remain part of the Core security boundary. The Console uses a server-side authorization-code exchange with PKCE. Signed browser cookies contain opaque references; provider credentials and OAuth tokens stay server-side. Password, security and passkey screens use the canonical account origin.Compatibility
Older Better Auth and Clerk adapters remain historical compatibility code and migration records. Their environment settings are not the current hosted sign-in setup. Do not enable them to bypass a managed identity mapping, link accounts by email or copy an old role projection into current authority. Existing OAuth issuer, registered clients, Studio resource audiences and website SSO contracts remain stable. The move to Neon Managed Auth does not turn a Neon credential into a Spitzli Cloud API token. See authentication.Source
The current implementation is in native identity (crates/identity), managed-session checks (crates/identity/src/neon.rs), all-user policy migration (crates/persistence/migrations/0070_neon_all_users.sql) and first-party browser sessions (crates/browser-session). Older README migration notes can predate this managed-auth implementation.