Tool Directory / Authentication

Ship login without building an identity provider

Authentication is the layer where rolling your own is technically easy and practically a bad idea. Sessions, password resets, OAuth callbacks, email verification, and account linking are each simple alone and a swamp together. Here is what to use instead.

Reviewed August 2026. Back to the tool directory.

What this layer decides

The real fork is where your users live. A library stores them in your own database, so a user row can be joined to an orders table and exported whenever you like. A hosted service stores them on someone else's, which buys you a pre-built UI, compliance paperwork, and an admin dashboard, at the cost of a foreign key you cannot join across and a bill that grows with your user count.

The second consideration is migration cost. Moving off a hosted provider means exporting password hashes, which some providers make deliberately awkward. Ask that question before signing up, not at 40,000 monthly active users when the invoice changes shape.

Libraries that keep users in your database

Better Auth

1.x - the current momentum pick

A framework-agnostic TypeScript library that ships email and password, OAuth, magic links, two-factor, passkeys, and organizations as first-class features rather than plugins you assemble. The core is MIT licensed and free forever, with paid enterprise add-ons for SSO and SCIM. It went from launch in 2024 to the default recommendation for new TypeScript projects in about eighteen months, which is unusual and earned. better-auth.com

Auth.js

v5 - established, slowing down

Formerly NextAuth, and still the most widely deployed open-source auth library in the React world with dozens of OAuth providers preconfigured. Free, self-hosted, and battle-tested. The friction is real though: the v5 configuration model confuses people, the docs lag the code, and release cadence has slowed. Keep it if you are running it; think twice before starting on it. authjs.dev

Hosted identity providers

You trade a monthly bill and a data boundary for a login screen you never have to design and compliance work you never have to do.

Clerk

Free to 50k MAU, then 25 dollars plus usage

The best drop-in auth experience available: prebuilt components that look good untouched, organizations and multi-tenancy handled, and an admin dashboard your support team can actually use. The free tier expanded to 50,000 monthly active users, which covers most products before revenue. Past that it is a per-user bill that grows fast, so model it at your target scale first. clerk.com

Supabase Auth

Free to 50k MAU, Pro from 25 dollars

Auth that lives inside your own Postgres database, which means user rows join to your application tables and row-level security policies can reference the logged-in user directly. That integration is the whole argument. It only makes sense if you are already using Supabase for the database, though the underlying GoTrue server is open source and self-hostable. supabase.com

Auth0

Free to 25k MAU - the enterprise option

Owned by Okta and priced for organizations with a procurement department. It handles SAML, enterprise SSO connections, custom rules, and compliance requirements nobody else bothers with. For a startup it is expensive and heavy for what you get. For an enterprise sales motion where a customer demands SAML federation next quarter, it is the safe answer. auth0.com

Three rules that apply whatever you choose

Authorization is still yours

Every tool here answers "who is this?" None of them answers "may they delete this record?" Permission logic belongs in your application and your database, and no auth provider will write it for you.

Passkeys are table stakes

Every option on this page supports WebAuthn passkeys now. Offer them alongside email login rather than instead of it, and skip SMS-based two-factor entirely - SIM swapping made it the weakest second factor available.

Test the export before you need it

Run a user export in the first week and confirm you get usable password hashes, not just email addresses. That single check is the difference between a weekend migration and a forced password reset for your entire user base.

Our pick

Better Auth, unless you are trading speed for money

Use Better Auth. Users live in your Postgres database, the cost is your database bill rather than a per-user rate, passkeys and organizations are built in, and there is no migration to plan because there is nothing to migrate off. It costs you a day of setup that Clerk would have given you in an hour.

Buy that day back with Clerk when time to market genuinely dominates - a funded startup racing a competitor, or a solo founder validating an idea this weekend. Choose Supabase Auth if Supabase is already your database. Choose Auth0 only when an enterprise contract requires SAML and someone else is paying.

Keep going

Clerk vs Auth.js

Hosted convenience against owning your own user table.

Read the verdict

SaaS stack guide

Auth in context with billing, database, and multi-tenancy.

See the stack

Internal tools stack

Where SSO against an existing directory beats any of this.