Auth
Buy auth from a vendor. Build it only when there is a real reason.
Authentication is the single most over-built piece of software in our industry. We almost always recommend buying it from a vendor — the threat model is wide, the failure modes are catastrophic, and the cost of doing it well is high.
For consumer apps with social login and email magic links, Clerk is the fastest path. For B2B SaaS that needs SAML SSO, SCIM, and audit logs out of the box, WorkOS wins. For enterprises with complex identity needs, Auth0 covers the long tail. We only build custom auth when a regulatory or product reason justifies it.
Tools we reach for
Clerk
Auth + user management for consumer and prosumer apps.
WorkOS
Enterprise SSO, SCIM, and audit logs for B2B SaaS.
Auth0
Mature identity platform with broad capability.
Custom JWT
When regulation, residency, or product strategy requires owning auth.
When we reach for it
- Clerk for consumer and prosumer SaaS
- WorkOS for B2B SaaS needing enterprise SSO
- Auth0 for complex identity, multi-app, or heavy compliance
- Custom JWT when there is a real reason — usually data residency or regulation
When we don't
- Custom auth as a default — almost always wrong
- Auth providers that lock you into proprietary user schemas
Frequently asked
Should we use Clerk or WorkOS?
Clerk if you serve individuals or small teams. WorkOS if you sell to companies that demand SSO and SCIM. Many B2B products use both — Clerk for the developer-facing dashboard, WorkOS for enterprise customers.
How do you handle MFA?
Every provider we use supports MFA — TOTP, SMS, and WebAuthn. We default to TOTP and WebAuthn over SMS.
Can we migrate off a provider later?
Yes. We design the user model so the provider is replaceable. We have done provider migrations for clients moving between Auth0, Clerk, and WorkOS.
Need a team that ships in this stack?
Tell us the workflow. A one-page summary back within 48 hours and a proposal within a week.