Ask HN: What type of Auth are you using on your side projects?

Auth.js!

Supported providers: https://authjs.dev/getting-started/providers/github

It's been really great so far and I can recommend it if you have a JS/TS codebase.

----------------------------

You can test Auth.js (v5 beta.22) in my Next.js 15 boilerplate:

https://achromatic.dev

• Credentials auth

• Google and Microsoft login

• Connected accounts

• Multi-factor authentication (via authenticator app)

• Session management

I've been in big tech and out of touch with the real world for a while, and I started a project only a couple of weeks ago to get a feel for what the cool kids are doing in web dev in 2024. So I can't claim any deep authority or experience with a lot of different approaches. But I picked Clerk because it was in a tutorial, and so far so good. It couldn't have been much easier, and the free tier seems more than generous enough to get through the prototype stage.

My main concern is that I don't want to weld too much of my design to any one service provider, so I've got to be careful about taking too much advantage of their feature set and API so that it won't be a pain if they go away or it becomes necessary to migrate to something else.

For admin panels, I use SSH port forwarding, as no additional configuration is needed for that. For users, I use email invite codes that contain the hash of the server’s public key and are pasted into a stand-alone client. That way, I don't need to maintain TLS certificates.

None, because my projects never make it as far as launching.

This is the absolutely simplest of authentication (not authorization) schemes I've used that is both easy for people to use and prevents the simplest of spam/robots:

- Be able to store two types of tokens, one that is temporary, and one that is "permanent"

- Users can use their email address to get sent a temporary token (which expires if unused after X minutes)

- Users can click that link to change the temporary token for a "permanent" token they (the frontend) can use for authentication

- Clicking "Logout" invalidates the currently used "permanent" token

Biggest issue is making sure that whatever email provider you use for the "Login Emails" consistently sends emails quickly, as there is nothing worse but sitting for 2-3 minutes waiting for a login email because the provider batches sends or something.

This would specifically be for side projects. If it grows beyond that, you really should implement something with proper rotation and more, but there are tons of resources about that out there.