Tell me about your experience with authentication services

I firmly believe that you should not roll out your own auth system if you are starting up.

Here are my reasons.

1. It's not your core offering. It's a non differentiating feature that you need to build as quickly as possible.
2. Security is complex and leaving it to someone who specializes in it is always better.
3. While you can roll out a user auth system pretty quickly by yourself, it will get harder to build more sophisticated features like MFA login, sign in with email etc later on.

So, if you are unsure, I would suggest Cognito/Okta.

Edit: just realized you prefer a 1:1 chat. I have scheduled a meeting as well.

What are you looking to chat specifically about. It would help to know how best to be prepared for a conversation.

For context, we run a company focused on IAM Authorization SaaS so we've integrated with almost every authentication solution out there. We have a somewhat comprehensive guide on AuthN SaaS selection available.

I've used the Amplify one. It 'just works.' If I coded my own, I can't think of anything I would improve, so I just use theirs, and I am sure that AWS' top-notch auth engineers know the subject better than I do.

I went on a deep dive of sorts and built my own, but take it from me that it's a huge time suck to learn and implement properly.

I will say it was not super easy to build. Between reading through specs and RFCs, learning different flows, verifying emails, allowing users to reset passwords, learning crypto libraries, and more, there's a decently sized barrier to entry for making auth that is ready for users. Pair that with spinning up the correct infrastructure to handle it all and it can blow up to be a pretty big component pretty quickly.

If you're doing it simply to learn, then I say do it. If you simply need auth for an application, then find a provider. I actually turned my auth lesson into an offering that that has a few other applications running off of it. I've scheduled a meeting on your calendar, but I wanted to make note of my opinion on this since it is near and dear to me. Also, I'm more than happy to talk to anyone else 1-on-1 about this in the future. Just reach out!

I'm in the camp of own your users. They are critical to the success of your business, and far too important to let someone else manage them. It might be a little bit of a pain and generic code, but its well worth it in the long run.

Building your own is an outdated way of doing thing unless you have a use case that no one is currently covering. There is almost no value in building your own Auth.

I rolled my own since our needs are not easily covered by available services. I run a video game studio, and we make games with full cross platform data portability (e.g. continue on Xbox where you left off on your phone).

Many game stores require only using their auth system, so I had to implement each platform's auth and centralize them into user accounts we manage. Some of those auth services are under NDA, and few other studios are doing the portability thing, so we're sorta on our own out here!

In addition to that it's important to us to own as much of our stack as we can so we can stay flexible. Plus, in games we tend to have low per-customer value but MANY customers, and some auth services are very expensive at scale.

You do have to be pretty fluent in auth flows and general web security stuff to stay out of trouble, so I tend to agree that using a service if you don't have the requisite knowledge. Especially if that service makes GDPR and other privacy compliance issues easy. Just make sure you'd be able to migrate your user data if you need to later!

I used to roll my own auth system for years in earlier projects. It all depends. If you're going for a (mostly) free B2C product, costs will be an issue if you choose any of the paid providers and exceed their free tier.

If you simply sell B2B or paid B2C, then go with someone else.

For my current project I use Auth0 - as promoted by @arvidkahl in his excellent book Zero To Sold. I'm still on the free tier but I know that once I want to add larger enterprise clients e.g. with SSO, I could price the cost in my offer, upgrade my account in minutes, adjust my implementation and be done with it.

I would never use one, it is a very important part of any SaaS, so being dependent on somebody else is a huge risk. What if they are down? What if my credit card is blocked by accident?

This comment has been voted down. Click to show.