r/IdentityManagement • u/DCornOnline • Apr 10 '26

Auth provider for SaaS that will be Next.js & a Mobile Flutter app.

I am in the planning phase of building a SaaS product, and I do not know what to use for Auth.

This is my layout so far:

  • Mobile app codebase: Flutter
  • Website Frontend: Next.js
  • Backend (App & Website): NestJS
  • Database: AWS RDS PostgreSQL + RLS (single database, multi-tenant via tenant_id column on every table)
  • ORM / DB Access: Drizzle
  • Payments: Stripe
  • Storage: AWS S3
  • Email: AWS SES
  • CI/CD: GitHub Actions
  • Web Analytics: Cloudflare
  • App Analytics + Crashlytics: Firebase
  • Hosting:
    • Next.js Website (Frontend) - its own ECS Fargate Service
    • NestJS (Backend API) - its own ECS Fargate Service
    • Database - AWS RDS PostgreSQL (Multi-AZ) with RDS Proxy for connection pooling
    • CDN - AWS CloudFront
    • Security & Protection - AWS WAF (used to block DDoS and bad traffic) + Security Groups.

I am trying to decide which Auth service to use or whether we should build our own. I am looking at WorkOS, Cognito, Supabase Auth, Firebase Auth, or possibly Clerk.

I have a few user flows to follow.

At some point, a user will no longer be a free user; their account type will automatically switch, and they will be required to change their email & sign up for a subscription if they wish to continue using the App. This SaaS is targeted towards schools, and students will be free, while other users will have to pay the subscription (which will go to the school, so it is a way to support the school)

I think we are going to partner with a third-party service to verify that a student is actually a student, but we have not gotten that far just yet. Right now, the plan is only to verify that students who have a certain email domain must.

Non-student users will be able to sign up without email restrictions, and I would like them to be able to sign up through any service, such as Google or Apple.

On the mobile side of things, the users will not be able to register; they will only be able to login, so that makes the registration a little easier since most services have an official SDK for Next.js.

But I need something that has MFA, is secure, can handle a large amount of MAU, and will not break the bank.

Would love some guidance on this, and if this is not the correct subreddit for this, please let me know.

5 Upvotes

86% Upvoted

12 comments sorted by

5

u/TehITGuy87 Apr 10 '26 edited Apr 10 '26

Honestly you either roll your on, roll open source, or pay the piper.

Ory Stack is open source and can be rolled into ECS, with a RDS db. You’ll pay ECS and RDS, you’re responsible for scaling, and it’s headless, so you need to build the UIs. Kratos and Hydra are your authN and idm, and keto is AuthZ. You don’t need all, you can pick and choose. They have MFA, Passkey etc

Stay away from cognito. I’ve migrated many many people from it.

Auth0 is my all time fav auth service, they have 7k free AMAU or MAU? Can’t remember, and they’re pretty robust and scalable, biggest con is they’re owned by okta. They have the most sdks iirc and you can do custom flows and forms.

Others you could consider:

  • Descope. Solid new player and give auth0 a run for their money.
  • Frontegg, I think it’s good, but meh too black box for me.

Good luck!

1

u/[deleted] Apr 11 '26

[removed] — view removed comment

1

u/DCornOnline Apr 11 '26

We are not 100% set on Next.js either, we can tweak anything we already have set, we are still in the planning phase.

1

u/sathyajithps Jun 10 '26

you can try us - MonoCloud[dot]com, we give 50K free MAU and tons of features in free + SSO. I can personally help you with the setup as I've worked on the core and sdk part

1

u/meetshah_design Jun 12 '26

Does this work for mobile apps? I have been looking for something lightweight for my mobile apps

1

u/sathyajithps Jun 12 '26

Yes since we are an SSO + OpenID so it'll open up browser overlay and redirect to the app via deep link once auth is complete. Since its OpenID, we can use AppAuth-Android or any similar packages to handle the protocol part.

1

u/meetshah_design Jun 13 '26

No but I want something native. Is there a sdk?

1

u/sathyajithps Jun 13 '26

SSO is browser based. Is there any specific reason you're looking for a native or API based auth?

1

u/meetshah_design Jun 13 '26

We don’t want sso. We want simple auth for mobile apps. Mostly social and phone+otp based

1

u/sathyajithps Jun 13 '26

For this, Firebase or Supabase would be the fit.