Pick a replacement by how much of sign-in you want to own. If you'd rather configure than code, a hosted auth service gets users logging in quickest. If you need to keep identity data on your own servers, choose an open source or self-hostable option. For B2B apps, check enterprise sign-on support before anything else.
Nobody wants to rebuild sign-in twice. It touches every user, every support ticket about a lost password and every security questionnaire a larger customer sends you, so the service you choose tends to stay for years. Below are eight options for developers adding authentication and user management, in no particular order, grouped by how much of the work they leave with you.
Single sign-on, directory sync and audit logs
WorkOS's own homepage leads with developer APIs and SDKs for enterprise-ready features: single sign-on, directory sync and audit logging. That focus is why many teams pick it when their first large customer asks for SSO. It's also why some look elsewhere, when what they need is mostly everyday sign-up and login rather than enterprise extras.
The thing to test in any replacement is simple to say and slower to check: how sign-in, SSO and user data are handled, and how much you build yourself versus configure in a dashboard. Two services can look identical on a feature grid and feel completely different once you're writing the login page, migrating password hashes or mapping a customer's directory.
Hosted, open source or somewhere between
Hosted services you mostly configure
Auth0, Clerk and Stytch handle the hard parts on their side and give you SDKs and APIs to plug in. They suit small product teams that want users signing in this week. The trade-off is that your user records live with the vendor, so read the export options early.
Open source and self-hostable
SuperTokens, Ory and FusionAuth give you more say over where identity runs and how it's shaped. They suit teams with data residency questions or strong opinions about their login flows, and they ask more of your engineers in return.
Built for B2B and AI agents
PropelAuth and Descope lean towards business software, where your customers are organisations rather than single users, and towards identity for AI agents as well as people. If enterprise buyers are your growth plan, start here.
Eight auth services, A to Z
Alphabetical and in no particular order. Every line reflects the vendor's own description.
Auth0
Best for: Product teams that want a ready-made platform for signing in users and AI agents; the vendor pitches it as production-ready and built to help you ship faster.
Clerk
Best for: Front-end developers on React, Next.js or Remix; the vendor says it's purpose-built for those frameworks and covers authentication and user management.
Descope
Best for: Teams designing sign-in journeys for customers, business partners, AI agents and MCP servers from one external identity platform, as the vendor describes it.
FusionAuth
Best for: Developers who want to shape their own login flows; the vendor lists SSO, MFA and OAuth2 and OpenID Connect support among its customisable tools.
Ory
Best for: Engineering teams that may want identity on their own servers; the vendor calls it cloud-native, API-first and self-hostable.
PropelAuth
Best for: Founders building B2B software who'd rather not hand-build auth; the vendor's idea is an auth product that gets out of your way, with tools ready out of the box.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Stytch
Best for: Developers who prefer to build authentication into their own interface with APIs and SDKs, which is how the vendor frames its approach to auth and security.
SuperTokens
Best for: Teams that want open source user authentication they can inspect; the vendor pitches building fast while keeping control.
How the eight compare at a glance
| Tool | Approach | Good for |
|---|---|---|
| Auth0 | Authentication and authorisation platform | Sign-up, login and access control for apps |
| Clerk | Drop-in auth for web apps | React and Next.js apps that need sign-in fast |
| Descope | External identity platform | Sign-in journeys for customers, partners and agents |
| FusionAuth | Customisable auth and user management | SSO, MFA and OAuth2 with room to customise |
| Ory | Cloud-native identity and access | API-first identity you can also self-host |
| PropelAuth | Authentication for B2B products | B2B software that wants auth out of the way |
| Stytch | Auth APIs and SDKs | Wiring sign-in and security in through code |
| SuperTokens | Open source authentication | Teams that want to read and own the auth code |
Advice before you migrate user accounts
Don't migrate everyone at once. Move new sign-ups to the new service first, keep existing users on the old one, and move them in batches once you've confirmed passwords, social logins and sessions carry across. Ask each vendor how password hashes are imported, because that one detail decides whether your users notice the move at all.
Then watch real people use the new flow. Small friction at sign-up loses customers quietly, and it's easier to spot when someone outside your team tries it; my piece on how UserTesting works for testers shows what that kind of session looks like from the other side. If a breach ever touches customer data, rules on notifying people vary by country, so check your regulator; affected customers often look for credit monitoring services as well.
Questions for your security review
- Where are user records and logs stored, and can you choose the region?
- Can you export every user, including password hashes, if you leave?
- Which enterprise sign-on standards are supported out of the box?
- How are multi-factor options set up, and can each customer enforce their own rules?
- What happens to sign-in if the service has an outage?
- Who on your team can change auth settings, and is every change logged?
Do you make authentication or identity software? Tool makers can ask to be considered for a featured place on this list.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
What's the difference between authentication and user management?
Authentication checks who someone is when they sign in. User management covers everything after that: profiles, roles, organisations, invitations and removing access when someone leaves.
Do I need SSO from day one?
Usually not. Most small apps start with email, password and social logins. SSO tends to matter once larger business customers ask for it, so choose a service that can add it later without a rebuild.
Is open source auth safer than a hosted service?
Neither is safer by default. Open source lets you inspect and host the code, but you take on updates and monitoring. A hosted service handles that for you, so judge each on how it's run.
Can I move users between auth providers without a password reset?
Often, if the new service can import your existing password hashes. Ask each vendor how imports work before you sign up, and test with a handful of real accounts first.
Are there legal rules on storing user data?
Yes, and they vary by country and industry. Check what your regulator expects on where data is kept and how breaches are reported, and ask each vendor where it stores records.
