Auth0

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Do not build this if you sell to enterprises. Consider it if you do not.

Two things carry the verdict, and they are different in kind. **SAML and enterprise directory connections** are what unlock large customers, and they are genuinely tedious — every provider is subtly different and getting a signature validation wrong is a security hole. **Attack protection** — credential stuffing detection, breached password lists, anomaly signals across many customers — is something a provider sees and you do not.

WHEN TO KEEP PAYING
- Customers ask for SAML, SCIM provisioning or an audit report
- You would rather somebody else be responsible when a login flow is attacked
- Compliance questionnaires are part of your sales process

WHEN TO BUILD
- Consumer product, ordinary sign-in, no enterprise buyers
- Then authentication is a known problem with reviewed libraries, and it is covered in full under Stytch elsewhere in this catalogue

WHATEVER YOU DECIDE, DO THESE
- **Passkeys first**, password second. Phishing-resistant, nothing to steal from your database, and support is now broad
- Check every new password against a breached-password corpus using k-anonymity so it never leaves your machine. That one check does more than any complexity rule
- Never reveal whether an address exists: identical responses and identical timing for a wrong password and an unknown account, on every route
- Rate limits per address hash and per account, on everything
- A password change or reset revokes every other session, and the user is told
- An append-only auth_events table. When somebody asks what happened to an account, that is the only answer you will have

THE MIGRATION QUESTION, ASKED EARLY
If you adopt a provider, check now how you would get out: can you export password hashes, or would every user have to reset? That answer decides whether this is a decision or a marriage.

THE ONE-LINE VERSION
Pay for the enterprise connections and the attack data. Do not pay to avoid learning how sessions work.