I had a fairly fun time using Auth0 a few years back. The ability to run arbitrary code hooks at various points allowed us to do pretty interesting stuff in a managed way without resorting to writing or self-hosting something that was entirely flexible.

Microsoft/EntraID does this too. The famous "Keep me signed in" and "Don't show this message again" buttons that don't do what they say they do, ever.

Maybe if enterprise sales decisions weren't made based on checklist and which account exec took them out on the best golf trip, we'd have better products.

It's a fair question. I found them way better to implement SSO in my small startup than OneLogin.

Using Auth0 in apps, I find their documentation bafflingly difficult to read. It's not like being thrown in the deep end unexpected to swim. It's like being injected at the bottom of the deep end.God help the poor non-native English speakers on my team who have to slog through it.

Security and safety is all over their marketing but I have yet to hear anything about them that doesn't indicate either bumbling incompetence or gross negligence.