Open Source Authentication and Authorization
I’m Rishabh and the co-founder and CTO at https://supertokens.com (YC S20). We offer open-source user authentication and we just released our user roles product for companies implementing authorization. Our users are web developers, and a prominent and adjacent pain point for our users is authorization. Developers typically implement two independent solutions for authentication and authorization. Offering AuthN and AuthZ in a single solution is something we’ve been thinking about for the last few years. Quick primer, authentication is knowing who the user is, and authorization is…
What it does
In the maker’s words, at launch
I’m Rishabh and the co-founder and CTO at https://supertokens.com (YC S20). We offer open-source user authentication and we just released our user roles product for companies implementing authorization. Our users are web developers, and a prominent and adjacent pain point for our users is authorization. Developers typically implement two independent solutions for authentication and authorization. Offering AuthN and AuthZ in a single solution is something we’ve been thinking about for the last few years. Quick primer, authentication is knowing who the user is, and authorization is knowing what the user has access to. A physical analogy: A person enters a building. Authentication means reading their ID card and knowing that the person’s name is John. Authorization means knowing which floors, offices, and files John has access to. With increasing privacy and data complexity, companies like Netflix[1], Slack[2], and Airbnb[3] have built out their own complex authorization systems. To build our user roles product, we started with a first principles approach of covering authorization use cases using scripting languages such as XACML and OPA. But looking at existing solutions built by talented teams like Oso[4], Aserto[5], Cerbos[6], Strya[7], we realized that while these were powerful solutions, they were often overkill for most early to mid-stage companies (especially on the B2C side). We went back to the drawing board, reached out to our users and after dozens of conversations, we realized that most authorization needs require the ability to 1. Assign and manage roles and permissions 2. Store roles in the DB and session tokens to make it readable on the frontend and 3. Protect APIs and websites based on these roles and permissions. And so, we built user roles – a simple RBAC authorization service that focuses on the balance between simplicity and utility. It doesn’t cover many complex cases and we’re not looking to displace any of the authorization incumbents. But you can add AuthN and AuthZ using a single solution, quickly. In the near future, we’ll be launching an admin GUI where you can manage your users and their roles with a few clicks. We’d love for you to try it out and hear what additional functionality you’d like to see. What are your favorite authentication providers and what do they get right? - [1]: https://conferences.oreilly.com/velocity/vl-ca-2018/cdn.orei... - [2]: https://slack.engineering/role-management-at-slack/ - [3]: https://medium.com/airbnb-engineering/himeji-a-scalable-cent... - [4]: https://www.osohq.com/ - [5]: https://www.aserto.com/ - [6]: https://cerbos.dev/ - [7]: https://www.styra.com/
Does the same job
all alternatives →
- OSOpen-source user onboarding and KYC flow made with Svelte (~50kb)2022 · github.com · ▲254
Hi everyone, We’re building an open-source identity and risk management platform and we’ve just released the first chunk of code, a fully customizable KYC flow & UI, to the public. We’ve chosen to use Svelte so our flows would be lightweight (it is ~50kb gzipped). Next up: - Adding forms and components for it to be used as a full onboarding flow. - Releasing an open-source case management dashboard, for manual approval of users. - Releasing an open-source rule engine, to help automate decisions. We’d love to hear your feedback, suggestions, or any question you’ve got. And if the rest of the…
- BOBoxyHQ – open-source alternative to Auth0/WorkOS2022 · boxyhq.com · ▲176
Hi HN, we are Deepak and Sama, co-founders of BoxyHQ (https://boxyhq.com/). BoxyHQ provides an open-source platform for developers to quickly integrate enterprise features into their software solutions. These include SAML Single Sign-On (SSO), Audit logs, with more to come :) Every B2B startup faces a common challenge when it comes to selling into the Enterprise; they need to allocate time and resources to support all the requirements to make their offering enterprise-grade. Supporting these requirements is a significant undertaking for the engineering team, especially since…
- SAStack, an open-source Clerk/Firebase Auth alternative2024 · stack-auth.com · ▲144
Hey HN! Happy to finally launch Stack. We made it because we like to put apps into production quickly, and authentication & user management was taking up way too much time. We have components like and that automatically adapt to whatever theme & design system you're using. Check the blog post to see the example with Radix UI and Joy UI. Also, there's an admin dashboard for monitoring and editing accounts. Stack is 100% AGPL/MIT-licensed, so you can self-host it. Cheers!
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
Lettertrace▲375Track your AI visibility for free (using your own API keys!)
Dev tools · 25d ago · lettertrace.com
Launched alongside, November 2022
the whole month →
- TC
I made a thing! In 2014, I was holding a stack of iPhones and thought to myself: "Hey, if I had each phone display a playing card, I could click a button and they'd shuffle themselves" I pared that idea all the way down to this: trading cards made of e-ink displays. Right now, each card costs me about $20 each, but with only a bit more scale, I think I can get that down to $10. In doing this project, I learned how to design electronics and circuit boards. I learned Rust and wrote my first driver, I upped my CAD skills, 3D printed, and did my first resin casting. I generated the images on the…
Dev tools · 2022 · wyldcard.io
