Decision record // Security
Buy authentication or build it?
Clerk, Auth0, WorkOS and the rest against rolling your own sessions. Building it looks like a weekend, and the weekend is real. What is not a weekend is everything that arrives afterwards.
The call
Buy it. The exceptions are narrow and you are probably not one of them. Then spend one hour owning your own user table anyway, because that is what actually decides whether you are locked in.
When each one is right
Buy it
- Essentially always, unless one of the two conditions opposite applies to you.
- You will want SSO, MFA or SCIM eventually, and eventually arrives sooner than anyone plans for.
- You would rather not personally reason about session fixation, refresh token rotation, account enumeration on the password reset flow, and revoking live sessions when someone changes their password. Each of those is a place to be quietly wrong for months.
Build it
- Authentication is the product. If you sell identity, you cannot outsource it.
- A hard requirement no vendor meets: an unusual identity model, an air-gapped deployment, or residency rules none of them satisfy.
What it costs you later
Lock-in is the objection people raise, and it is not the one that bites. What bites is putting the vendor's user ID into every foreign key in your schema. Create your own user row with your own primary key the first time somebody signs in, store the vendor's ID as one column on that row, and reference your ID everywhere else. Do that and changing provider is a migration on a single table. Skip it and it is a rewrite of every table you own, at exactly the moment you are already unhappy with the vendor. It costs about an hour at the start and it is the cheapest insurance in this entire catalogue.
Decisions like this one, on your product
This page is a general answer. Yours has constraints I don't know about. The Founding Engineer is 8 weeks with 5 founders where we make these calls on your actual codebase, and your code gets reviewed every week.
New decision records as I write them
One question, one answer, no hedging. Leave your email and I'll send the new ones. No schedule promises, unsubscribe anytime.