User System & Auth
Identity, authentication, and account management for your users.
Options
Authentication Methods*
Access Control*
Multi-factor Authentication
Decision Points
Will this product be sold to businesses (B2B)?
If yes
Add SAML/SSO and RBAC. Enterprise procurement often requires both.
If no
Email + password plus one OAuth option covers 95% of consumer use cases.
Is this a security-sensitive application?
If yes
Enable TOTP MFA. Consider making it mandatory for privileged users.
If no
MFA is optional — offer it but do not require it to reduce friction.
Email+password, passwordless, or SSO-only?
If yes
Passwordless (magic links or passkeys) eliminates password reset tickets and credential stuffing risk.
If no
Keep email+password as a universal fallback — OAuth outages should not lock users out.
Do you need social providers (Google, GitHub, Apple)?
If yes
Add Google for B2C breadth; add GitHub for developer tools; add Apple only if you ship iOS (App Store requires it when you offer other social login).
If no
Skip social OAuth and avoid the app registration / key rotation overhead.
Do you need SCIM provisioning?
If yes
Add SCIM alongside SAML — enterprise IT uses it to auto-provision/deprovision employees and map group membership to roles.
If no
Manual invite flows are fine until your first enterprise customer asks for SCIM in a security review.
Should MFA be required, optional, or risk-based?
If yes
Risk-based (step up MFA on new device, new IP, or sensitive actions) gives security without friction on every login.
If no
Offer MFA as optional first; require it only for admins or on privileged actions.
Which MFA factors will you support (TOTP, SMS, WebAuthn/passkeys, hardware keys)?
If yes
Prefer WebAuthn/passkeys and TOTP. Avoid SMS as a primary factor — SIM swapping is a real threat.
If no
TOTP alone (Google Authenticator, Authy) covers the vast majority of users with minimal implementation cost.
Do you need device fingerprinting or trusted-device flows?
If yes
Remember trusted devices for 30 days to skip MFA; challenge on new device or changed fingerprint.
If no
Re-prompt MFA on every login — simpler and safer for low-volume or highly sensitive apps.
Offer passkey-only sign-in?
If yes
Passkeys eliminate passwords entirely — use WebAuthn with platform authenticators. Still keep an email recovery path for lost devices.
If no
Offer passkeys as an optional second factor; users without compatible devices keep using passwords.
Support staff impersonation of user accounts?
If yes
Add an impersonation flow that logs both the staff identity and the target user, with a visible banner in the impersonated session.
If no
Skip impersonation — instead build admin-side read views and support tooling that do not require acting as the user.
Captcha or bot detection on signup?
If yes
Add hCaptcha or Cloudflare Turnstile on signup and password reset — invisible challenges avoid user friction.
If no
Skip captcha for internal tools or invite-only products where bot signups are not a realistic threat.
Use lockout or rate-limit throttling for credential stuffing?
If yes
Exponential rate limits per IP and per account — lockouts create support tickets and denial-of-service vectors via targeted lockout.
If no
If account takeover risk is low, a simple fixed rate limit (e.g., 10 attempts per 15 min) is sufficient.
Allow multiple concurrent sessions per user?
If yes
Show active sessions in account settings with a revoke button — expected behavior for any multi-device product.
If no
Single-session apps (banking, compliance) should terminate old sessions on new login.
Tradeoffs
Each provider requires an OAuth app registration and key rotation policy
Requires IdP partnership and XML-based protocol handling; significant integration work
Permission checks must be applied consistently across every data access path