Ask HN: How are you implementing membership/auth for your SaaS or other project?
I have a side project that will involve subscriptions. I would like to offload as much of the db/code overhead that comes with membership data, auth, payment processing, etc, as possible, without paying enterprise-level fees. I thought about having a Squarespace site and just integrating my backend API, but I'm thinking my application will be just complex enough to prohibit that approach. What is everyone using, and what small-scale third party membership integrations do you suggest? Any feedback appreciated.
18 comments
One approach:
There are skeleton projects for each framework (Django, Node, etc.) that will take care of all this. One-time fee. You'll have to maintain it. But it's great to get started.
Basically, search for "saas boilerplate" or "saas skeleton".
There are skeleton projects for each framework (Django, Node, etc.) that will take care of all this. One-time fee. You'll have to maintain it. But it's great to get started.
Basically, search for "saas boilerplate" or "saas skeleton".
I do sessions-based authentication via my API server. You can implement this in quite a few ways, but I think Redis is pretty common for the speed. I think there are libraries in most languages that should implement this in some way or another, but it isn't too hard to do by yourself either.
JWT also works very well if you don't need the ability to immediately revoke access, since in an efficient JWT implementation, you'd only be refreshing the token at specific intervals.
I also have a couple of flows set up to authenticate users via the Facebook and Google OAuth APIs, tying them to my own users' accounts.
JWT also works very well if you don't need the ability to immediately revoke access, since in an efficient JWT implementation, you'd only be refreshing the token at specific intervals.
I also have a couple of flows set up to authenticate users via the Facebook and Google OAuth APIs, tying them to my own users' accounts.
Dont start with JWT. It’s better to start with a traditional system and move to more complex/novel solution as the system grows.
Stripe Billing handles subscriptions and renewals. From there you’re just a few webhooks away from tying that with whatever auth solution you go with.
We use Chargify for handling subscription signups and taking money. It connects with Auth0 for our user authentication and management. They're both inexpensive and you can set them up by yourself.
Check out https://github.com/saasform/saasform
(I'm a co-founder, feel free to reach out directly.)
(I'm a co-founder, feel free to reach out directly.)
Firebase Auth is my go-to, but I don't consider myself an expert as I only work with TypeScript and React/Nextjs. I still have to do some hands on work managing the user session, and relating users to other related records in Firestore. And their prebuilt UI components can be problematic. And of course I have to keep user data in sync with payment state by handling Stripe events.
I'd love to find something even more hands-off for my next project...
I'd love to find something even more hands-off for my next project...
See my comment here: https://news.ycombinator.com/item?id=26859182
SuperTokens is open source auth that is free and easy to setup. Our frontend UI is also far easier to customize
SuperTokens is open source auth that is free and easy to setup. Our frontend UI is also far easier to customize
I have a side project successfully utilising Firebase auth. But do understand that this is a “sticky” approach. Moving away (for whatever reasons) is difficult. You want to have a clear migration strategy if you opt for 3rd party auth mechanism. You don’t want a vendor owning your customers. I have heard of Auth0 and would recommend exploring it for the reason that OAuth based approaches will provide you decent portability.
Firebase is great.
Check out SuperTokens.io too. We provide open source authentication as an alternative to SaaS provides such as Auth0 and Keycloak. Its free, writes to your own database (so you own your own data) and is built to be dead simple to setup.
Disclaimer: Cofounder of SuperTokens.io here. Would love to hear what you think
Check out SuperTokens.io too. We provide open source authentication as an alternative to SaaS provides such as Auth0 and Keycloak. Its free, writes to your own database (so you own your own data) and is built to be dead simple to setup.
Disclaimer: Cofounder of SuperTokens.io here. Would love to hear what you think
Same boat, I will add:
- Firebase has tooling for user export now, you can migrate away
- Custom JWT token auth means you can build / extend your auth system in the future
- Firebase Auth is free and really easily decoupled from the other products – you don't need them.
- Firebase has tooling for user export now, you can migrate away
- Custom JWT token auth means you can build / extend your auth system in the future
- Firebase Auth is free and really easily decoupled from the other products – you don't need them.
[deleted]
Very interested in this. I’ve written this in multiple projects. Have always thought it’d be cool to extract out but never got too.
I’ve used auth0 before. It was way easier to understand than Okta.
Why do you think your site would be too complex?
I’ve used auth0 before. It was way easier to understand than Okta.
Why do you think your site would be too complex?
Laravel spark is something im using but not actively charging for
You need customers for that
You need customers for that
Mostly Flask with helper packages. But also userbase.com for howsyourblank.com and just a phone number for textpost.me :)
Flask with jwt
Stripe for bills
Firebase for the auth