Ask HN: Which Auth Service for SaaS? | Hacker News Reader

Ask HN: Which Auth Service for SaaS?

6 pointsbert20029 comments

How did you decided which authentication service you use for your Saas? Built in or external service provider?

It depends on what your needs are. If you need simple auth for a single application, most languages have libraries/frameworks that cover most of your needs and are relatively trivial to implement. In .NET land you have Identity[0] for example. You just need to look up what is the most popular option for the tech you're using and if it ticks all your boxes.

If you're looking for a full fledged service that offers SSO and that you can self host (or cloud) with SDKs for most of the popular languages out there, then I'd recommend to look at Ory[1].

[0] https://docs.microsoft.com/en-us/aspnet/core/security/authen... [1] https://www.ory.sh/

The problem with simple auth is that it gets complicated with TOTP/2FA which I believe is necessary nowadays. I think you are right so see what is most popular with the language (python in my case) and stick to it, but there are lots of Identity providers our there and they have different pricing schemes. I will definitely check out ory.sh I have not heard of them before.

If you're just building an MVP I think doing "magic link" auth is underrated. It's super easy to set up, relatively secure, doesn't need any of the complexity of passwords/sso, and is easy to migrate to a different system in the future.

Auth0 is complete overkill if you don't need their advanced features IMO.

I really like magic link + 2FA which gives a bit more security.

Auth is zero value-add table-stakes requirement with a lot of complexity. I haven't a seen a product with enough built-in. External provider is the way to go.

I tend to agree, but which provider do you use?

Depends on features and budget. AWS Cognito is very cheap, but not many features out of the box. Google Cloud Identity Platform seems to be same category as Cognito with some differences. Auth0 is a little more expensive, but has a lot of features. There are others like Ory, KeyCloak, etc.

I prefer auth0. It's simple enough for a simple SaaS.

it seems quite pricey for a vendor lock in option or not?

Reply on news.ycombinator.com