gotrue

nix framework for Elixir has a built in command which scaffolds auth, and it works really well (I have used it in a personal project): https://hexdocs.pm/phoenix/mix_phx_gen_auth.html. For JS, you can use something like passport: https://www.passportjs.org/packages/passport-local/. If you want a separate service entirely (even though it would be more complex to have a separate service to start out), there is GoTrue: https://github.com/netlify/gotrue. These are just a few suggestions of tech I have come across. There is so much more out there, I encourage you to research options to see what may be a best fit. If you're worried about password auth, maybe give one time passwords a try. They don't require any password reset flow, and are generally secure when implemented correctly. As an example, I don't have a password for my craigslist account. Every time I want to login, I can choose to get a magic link/otp which gets exchanged for a session. In practice (and this is my personal opinion), I prefer magic links. They are one time, hard to guess (again dependent on implementation), can be time limited, and most likely won't be intercepted in transit (though it could be in a rare circumstance). --- To answer point 2: yes. If your app is to order things (I use things in a general term) it sounds like eCommerce. And if you're in eCommerce, you better have a way for a user to track what they have ordered and how much they have paid for it at a minimum. Otherwise, your site may come across as a scam, even though it uses Stripe. Sketchy sites can use Stripe to get your money (albeit, it'll be a one time payment). --- In conclusion, auth for your application seems crucial. Email/password auth is still relevant for applications. While not necessary for an MVP, there is a segment of the market you will lose if you don't have an email/password option, or even an email/OTP/magic link option (I don't know how much, really going off an educated guess). Best of wishes in building your app! I genuinely hope it is successful and safe for people to leverage :) --- Edit 1: You may not need auth after all. After thinking a bit more about some UX from different ordering services (i.e. airlines, doordash). Maybe a way to circumvent is to send that order number w/ an order summary via email, which of course you have stored in your db. You may still need to store an email (depending on the complexity of an order number), but it wouldn't require a full on auth solution to start out with. It would make my points above moot, and may be lowest friction way for you to get your app off the ground while still giving a user the ability to have access to their orders/order history.

them have very permissive licenses) [EDIT] More entries for this list in another comment @ https://news.ycombinator.com/item?id=26411457 [0]: https://www.keycloak.org/ [1]: https://github.com/cloudfoundry/uaa [2]: https://gluu.org/docs/gluu-server/4.2/ [3]: https://github.com/ory/hydra#what-is-ory-hydra [4]: https://keratin.github.io/authn-server/ [5]: https://github.com/tremolosecurity/openunison [6]: https://github.com/dexidp/dex [7]: https://github.com/netlify/gotrue

few roles in your database: one “anon” role which is restricted, and one “authenticated” role which users can “assume” once they are logged in. Inside your database, you can then add Postgres Policies[4]. These are incredibly powerful (see Steve’s “social network” database[5]). Admittedly they can be confusing, but we have plans to make them simple. Their flexibility outweighs their complexity in any case. Authentication: After trying many open source tools, we found Netlify’s GoTrue[6]. This was simple and covered most of the functionality we need. There are some missing Oauth clients, so we will contribute them when we roll out Oauth (we only have email login for now). When a user starts a new Supabase project, we create an “auth” schema in their database. GoTrue stores the users and user data in this schema. AuthN+AuthZ: when a user signs up to your app/project, GoTrue assigns them a unique UID, saves them in the auth schema, and returns a JWT with the user’s details. Our client library attached this JWT to every API request. PostgREST validates the JWT then sends the request through to Postgres. Postgres is able to inspect the request header to get the user’s role and UID, but to make this easy we added some helper functions to the auth schema: one to get the logged in user’s UID (`auth.uid()`) and one to get the logged in user’s role (`auth.role()`). These functions can be used in the Postgres Policies to create a very powerful rules engine. Postgres is one of those tools which you love the more you use it. RLS+Policies are no exception here. It’s very cool being able to specify rules in your database and then be carefree in your frontend. We hope you’ll try it out and send feedback. Note - we’re still in alpha! Please be lenient :). There are some missing features (we’ll be enabling email confirmations/password reset in 1 or 2 weeks) [1] Previous Launch: https://news.ycombinator.com/item?id=23319901 [2] RLS: https://www.postgresql.org/docs/current/ddl-rowsecurity.html [3] PostgREST auth: http://postgrest.org/en/v7.0.0/auth.html [4] Policies: https://www.postgresql.org/docs/current/sql-createpolicy.htm... [5] Social network: https://github.com/steve-chavez/socnet/blob/f1abaadaaedb7c8e... [6] GoTrue: https://github.com/netlify/gotrue