What should I use for auth in a SaaS app that may need enterprise SSO later?

If you think you may need enterprise SSO later, I’d strongly recommend using an auth provider that already supports:

• Email/password + social login for SMB/self-serve
• OIDC/OAuth2 as the core protocol
• SAML for enterprise SSO
• SCIM for user provisioning/deprovisioning
• MFA / passkeys if possible
• Organization / tenant support built in

Good default choices

Best “don’t paint yourself into a corner” options

• Auth0: very full-featured, common choice for SaaS with enterprise needs
• WorkOS + your own auth: great if you want to own more of the auth flow but add enterprise SSO later
• Clerk: excellent developer experience; check enterprise SSO depth for your needs
• Firebase/Auth: fine for basic auth, but enterprise SSO often becomes awkward later

If enterprise is likely

A common pattern is:

• Start with hosted auth (Auth0 / Clerk / WorkOS / Okta CIC)
• Model your app around organizations/tenants from day one
• Use OIDC internally
• Add SAML/SCIM when enterprise customers ask

If you want maximum control

Use:

• Your own app auth with sessions/JWTs
• Add WorkOS later for SSO/SCIM This can be a good balance if you want to avoid being locked into a heavy auth vendor.

What I’d avoid

• Rolling your own full auth system from scratch
• Choosing a tool that only does basic OAuth/social login with no SAML/SCIM path
• Hard-coding users as “accounts” without a tenant/org model

My practical recommendation

If you want the safest path:

• Early-stage SaaS with likely enterprise future: Auth0 or WorkOS
• Need best DX and simple app auth now: Clerk, but verify enterprise roadmap fit
• Want to own auth and add enterprise later: Custom auth + WorkOS

If you tell me:

1. your stack,
2. whether you need B2C, B2B, or both,
3. whether enterprise SSO is “maybe someday” or “likely within 12 months,”

I can recommend a specific setup.