What should I use instead of building auth myself?

If you’re thinking “I should build auth myself,” the usual answer is: don’t unless auth is your product or you have a very specific, unusual requirement.

Good alternatives

1) Use a managed auth provider

Best if you want to move fast and avoid security footguns.

Common options:

• Auth0
• Clerk
• Firebase Authentication
• AWS Cognito
• WorkOS for B2B/enterprise SSO
• Supabase Auth

These typically handle:

• sign up / sign in
• password resets
• email verification
• MFA / 2FA
• social login
• SSO / SAML / OIDC
• session handling
• security updates

2) Use framework-provided auth helpers

Best if you want more control but still avoid reinventing everything.

Examples:

• NextAuth / Auth.js for Next.js
• Django auth
• Rails Devise
• Laravel Breeze / Jetstream / Fortify
• ASP.NET Identity
• Spring Security

These are better when:

• you want auth integrated tightly with your app
• you’re okay managing more of the logic yourself
• you don’t need a full SaaS auth platform

3) Use an identity standard + external IdP

Best for enterprise or complex ecosystems.

Use:

• OAuth 2.0
• OpenID Connect
• SAML for enterprise SSO

Pair that with an identity provider like:

• Okta
• Azure AD / Entra ID
• Google Workspace
• Auth0
• Ping Identity

My practical recommendation

• Startup / small product: Clerk or Auth0
• Firebase-first app: Firebase Auth
• Supabase app: Supabase Auth
• B2B enterprise SSO: WorkOS or Auth0/Okta
• Traditional web app with a framework: use the framework’s auth library

When you might build your own

Only if:

• auth is the core product
• you need highly custom flows
• you have strong security expertise and ongoing maintenance resources
• you’re implementing against a strict internal security architecture

If you want, I can recommend the best option based on your stack (Next.js, Django, mobile app, etc.) and your needs (social login, passwordless, enterprise SSO, MFA).