I'm building a new app and want one login system for web and mobile. What should I use?

Use a single identity provider with OAuth 2.0 + OpenID Connect (OIDC), and have both web and mobile apps authenticate through it.

Best-practice setup

• Web app: OIDC Authorization Code Flow
• Mobile app: OIDC Authorization Code Flow with PKCE
• Backend APIs: Validate access tokens issued by the identity provider

Good choices for the login system

Depending on your needs:

Managed options

• Auth0
• AWS Cognito
• Firebase Authentication (simpler, good for consumer apps)
• Azure AD B2C / Entra External ID
• Okta

Self-hosted / more control

• Keycloak
  Good if you want to run your own auth server and keep costs predictable.

Why this is the right approach

• One login works across web and mobile
• Users can sign in with email/password, social login, SSO, etc.
• Tokens are standardized and secure
• Easier to add features later like MFA, passwordless, and account linking

What to avoid

• Don’t build your own password storage and session system unless you absolutely must
• Don’t use the same auth mechanism for web and mobile unless it’s designed for both
• Don’t pass long-lived credentials directly to the app

Simple recommendation

If you want the fastest path:

• Start with Auth0 if you want ease of use
• Start with Cognito/Firebase if you want lower cost or tighter cloud integration
• Start with Keycloak if you want self-hosted control

If you want, I can also suggest the best option based on your stack:

• React / Next.js
• iOS / Android / React Native / Flutter
• Node / Django / Rails / .NET backend