Clerk

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Do not build this to save money — but be clear about what you are buying, because it is unusual.

It is **being responsible when it breaks**. Session handling, token rotation and revocation done by people who think about it full time, and sign-in components that already handle every awkward state: an expired link, a half-finished sign-up, an email that has been changed, an account that exists under a social login the user has forgotten about. Those states are where homemade authentication actually fails, and they are dull rather than difficult.

WHEN TO KEEP PAYING
- A small team where nobody wants to own authentication at three in the morning
- You need organisations, roles and invitations, and you want them next week
- The cost of a mistake here is somebody else's account, and you would rather that risk sat elsewhere

WHEN TO BUILD
- Authentication is a known problem with reviewed libraries, and the full shape is covered under Stytch elsewhere in this catalogue
- Do it if you want the users in your own database and no vendor in the login path

WHATEVER YOU CHOOSE, THESE ARE NOT OPTIONAL
- **Passkeys first**, password second. Phishing-resistant, nothing to steal from your database
- argon2id for any password, and check new ones against a breached corpus with k-anonymity so it never leaves your machine
- Session tokens long, random, stored hashed, httpOnly and secure, short-lived with a rotating refresh, revocable centrally
- Identical responses and identical timing for a wrong password and an unknown address, on every route
- Rate limits per address hash and per account, everywhere
- A reset revokes every other session and the user is told
- An append-only auth_events table, because it is the only thing that answers what happened to an account

ASK THE EXIT QUESTION FIRST
If you adopt a provider, find out today whether you could export password hashes and user identifiers. If the answer is no, every user resets their password on the way out, and that is a decision to take knowingly.

THE ONE-LINE VERSION
Pay to move the risk, not to avoid understanding it — and check how you would leave before you arrive.