{"id":"auth","slug":"auth","name":"Product authentication","shortName":"Product authentication","problemStatement":"User signup/login/organizations for an agent product.","whenNotTopPick":"Enterprise SSO-first motion — WorkOS. Full IdP customization — Auth0. Want auth+DB one vendor — Supabase.","categoryIds":["cat-auth-payments"],"depotPickProviderId":"clerk","depotPickRationale":"dx + capability orgs + maturity.","runnersUpIds":["auth0","supabase-pgvector","workos","stytch"],"weights":{"capabilityFit":0.24,"pricePerformance":0.14,"latencyReliability":0.14,"developerDx":0.24,"privacyPosture":0.1,"lockInRisk":0.08,"maturity":0.06},"methodologyNotes":"dx + capability orgs + maturity.","tags":["auth"],"depth":{"whenNotToUse":{"text":"Enterprise SSO-first motion — WorkOS. Full IdP customization — Auth0. Want auth+DB one vendor — Supabase.","source":"editorial `whenNotTopPick` (data/jtbds.json)"},"whenNotToUseReason":null,"runnerUp":{"providerId":"auth0","name":"Auth0 (Okta)","overallForJob":7.76,"pickOverallForJob":8.5,"beatsPickOn":["capabilityFit","latencyReliability","privacyPosture","maturity"],"source":"first resolvable entry of the job's editorially ranked `runnersUpIds`; scores are stored job-weighted scores"},"runnerUpReason":null,"lockIn":{"pickLockInRisk":6.5,"runnerUpLockInRisk":7,"scale":"0–10 stored curated estimate; higher = more lock-in (worse)","pickExitSignals":[],"runnerUpExitSignals":[],"pickNotes":[{"text":"Migration off Clerk takes work","field":"weaknesses"}],"selfHostFallback":[],"migration":"The pick has lower stored lock-in risk than runner-up Auth0 (Okta) (6.5 vs 7).","migrationReason":null,"derivedFrom":"stored lockInRisk scores, provider tags (oss, self-host, openai-compat, open-models), free rows that list this job, and verbatim provider notes. No migration guide was invented."}},"freshness":{"pick":{"score":{"asOf":"2026-10-19","ageDays":8,"stale":false,"staleAfterDays":30,"reason":null},"lastReviewed":{"asOf":"2026-10-19","ageDays":8,"stale":false,"staleAfterDays":30,"reason":null},"sourceCheck":{"checkedAt":"2026-10-27","sourceUrls":1,"sourcesReachable":1,"pricingRows":0,"pricingRowsReconfirmed":0,"note":"A source re-check confirms the page is reachable and, for pricing rows, that the stored amount and SKU name appear on it. It does not re-derive or change the score.","reason":null}}},"depotPick":{"id":"clerk","slug":"clerk","name":"Clerk","tagline":"Depot default auth for agent products with users. WorkOS when enterprise SSO is the main job.","overall":8.5},"runnersUp":[{"id":"auth0","slug":"auth0","name":"Auth0 (Okta)","tagline":"Enterprise identity Swiss Army knife. For startups, Clerk/WorkOS usually hurt less.","overall":7.76},{"id":"supabase-pgvector","slug":"supabase-pgvector","name":"Supabase (pgvector)","tagline":"Depot default for most agent apps under ~25–50M vectors. Don't add Pinecone until Postgres actually hurts.","overall":8.66},{"id":"workos","slug":"workos","name":"WorkOS","tagline":"When your first big customer asks for Okta SSO tomorrow, WorkOS is how you say yes without a rewrite.","overall":8.6},{"id":"stytch","slug":"stytch","name":"Stytch","tagline":"Auth pick when agents/M2M + org SSO matter more than Clerk's consumer UI kit. Watch Twilio integration…","overall":8.35}]}