Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Open-Source Auth for NextJS / React

ory.dev

Post reply on HN
Print view View original

41–50 of 52 posts

Re: Show HN: Open-Source Auth for NextJS / React

#41

Post by Sytten »

mooreds wrote: post #31
Sytten wrote: post #24

Earlier quoted context omitted.

If I have a suggestion for the cloud pricing, I would move away from the per user model that every competitor uses. It is a non-starter for all the B2C startups where a user might login once to buy a thing and never login again during the month/year. That is will I am not suggesting any auth provider to my clients and I recommend they use passport/build it in house. I really prefer to have pricing per API calls (in c…

@sytten, interesting feedback. How would you feel about MAU pricing that varies? If you are an app for schools and students, you might have 300k users in Sep-May, but 10k users in Jun-Aug. Would you feel comfortable if the cost went down during the low traffic months to a lower band, based on the 10k users? Or is that still a non-starter?

Everything that is per user is a non-starter in my book.

Because the vast majority do 1-2 API calls to login once, are considered active and then never login again during the month. But you still have to pay as if it was active for the whole month.

That is why per API call pricing (a la AWS S3) or resources based pricing (1 CPU) is the best.

Re: Show HN: Open-Source Auth for NextJS / React

#42

Post by Sytten »

claystraw wrote: post #25
Sytten wrote: post #24

Earlier quoted context omitted.

If I have a suggestion for the cloud pricing, I would move away from the per user model that every competitor uses. It is a non-starter for all the B2C startups where a user might login once to buy a thing and never login again during the month/year. That is will I am not suggesting any auth provider to my clients and I recommend they use passport/build it in house. I really prefer to have pricing per API calls (in c…

Thank you Sytten, this comment makes me happy because it confirms our bias! MAU pricing has always been my personal enemy. Ory is and never will charge on a MAU basis. Instead, we'll be working with CPU, Memory, and Disk usage (like any other cloud provider) and with additional services on top. We're not fully there yet to communicate this clearly, but if you're interested check out the pricing page to understand whe…

I suggested that because the pricing page said 900 free users and that got me worried. Glad to see you are moving in the right direction!

I think you might want to try the API calls pricing model (a la S3) because as a dev I usually don't know how much resources I need. But I can estimate that if I have X user that login each day that makes Y API calls which translate to Z$ (with proper spamming protection of course).

Re: Show HN: Open-Source Auth for NextJS / React

#43

Post by [deleted] »

Sytten wrote: post #24
claystraw wrote: post #11

Earlier quoted context omitted.

Both! :) Ory Cloud is still in it's early phases and we have not been very good at communicating it well. Basically, we run Ory Kratos in Ory Cloud and it has full API and configuration and data compatibility with the version that is on GitHub! Our goal is to also allow users to easily switch from self-hosted to ory cloud and back - but it's still a bit of work until we get there. If you just want to check our Ory Kr…

If I have a suggestion for the cloud pricing, I would move away from the per user model that every competitor uses. It is a non-starter for all the B2C startups where a user might login once to buy a thing and never login again during the month/year. That is will I am not suggesting any auth provider to my clients and I recommend they use passport/build it in house. I really prefer to have pricing per API calls (in c…

[deleted]

Re: Show HN: Open-Source Auth for NextJS / React

#44

Post by Aeolun »

Sytten wrote: post #42
claystraw wrote: post #25

Earlier quoted context omitted.

Thank you Sytten, this comment makes me happy because it confirms our bias! MAU pricing has always been my personal enemy. Ory is and never will charge on a MAU basis. Instead, we'll be working with CPU, Memory, and Disk usage (like any other cloud provider) and with additional services on top. We're not fully there yet to communicate this clearly, but if you're interested check out the pricing page to understand whe…

I suggested that because the pricing page said 900 free users and that got me worried. Glad to see you are moving in the right direction! I think you might want to try the API calls pricing model (a la S3) because as a dev I usually don't know how much resources I need. But I can estimate that if I have X user that login each day that makes Y API calls which translate to Z$ (with proper spamming protection of course)…

I think the pricing page suggests that if you sign up now, you won’t be paying the $21/month fee (for one year).

It’s hard to use the correct terms when you have users signing up to user management as a service xD

Re: Show HN: Open-Source Auth for NextJS / React

#45

Post by rad_gruchalski »

bsid wrote: post #36
claystraw wrote: post #28

Earlier quoted context omitted.

Clerk (your profile says you're CTO) has a per-user pricing though? Or are you planning on changing it? > It says "First 900 free" and "First 100 free" without any indication of what those numbers mean. Thank you, we'll clarify that! It means that we're giving the first 900 "start up" and 100 "growth" plans away for free for a year

Ahh, that makes sense, cool! Yes, I am the CTO @ Clerk, and we do have per-user pricing right now, however, that doesn't mean we like it. It's something we've struggled with - how do you make pricing scale in some way, while still being clear, while also being predictable. There's also value in being in-line with the status quo - when your numbers are priced competitively using the "industry standard (auth0)" scale.…

> Per API call seems more predictable, but still not as clear as the "at a glance, MAU number" Do product managers know how many API calls your average user would use? Yes, auth is most often implemented by devs, but are they always the buyer?

I’ve done some research into Hydra: https://gruchalski.com/posts/2021-05-23-do-you-really-need-a....

Re: Show HN: Open-Source Auth for NextJS / React

#46

Post by d0100 »

When using this, where can a get a deep dive into the architecture and details around the system?

I'm always hesitant to use third party Auth for fear that some bug in our app would generate otps and I won't be able to fix that in an emergency because of a lack of familiarity/access to source code/database

Re: Show HN: Open-Source Auth for NextJS / React

#47

Post by bsid »

boneabcd wrote: post #35
bsid wrote: post #18

Earlier quoted context omitted.

checkout - https://clerk.dev/solutions/nextjs-authentication , the middleware works like you're talking about. It's lighter weight than ory, i think. I've struggled to figure out how all of ory's pieces fit together, however their upcoming cloud offering may resolve some of those challenges!

From reading the linked article it seems fairly easy to use. Do you have some concrete examples why your solution would be "lighter"? I'd actually say it's heavier since you have to pay and end up in a "custom pricing scheme" (whatever that means) for 10k+ users as it says on your website. And it's also only available as a cloud service, with all the vendor lock in shenanigans everyone hates. By the way people usuall…

didn't mean to talk bad... nothing but respect for everyone involved in this project. my comment was very hasty -- and you're right I should have disclosed up front that I'm working on a product in a similar space.

Ory has been around for awhile, they're quite the gorilla in the identity space - It's a set of very large, and very impressive products that work well together. It is extremely powerful, flexible, and can handle almost any use case. I'd define "lighter" as being more opinionated in it's approach with fewer options - as a result it's less powerful and flexible. Also, w/ open source, comes setting up your own infra (even if that's now just throwing it in a cloud), which I'd consider "heavier". Imo, these terms don't mean something is worse than something else, just a fit for a different use case.

Re: Show HN: Open-Source Auth for NextJS / React

#48

Post by mooreds »

Sytten wrote: post #41
mooreds wrote: post #31

Earlier quoted context omitted.

@sytten, interesting feedback. How would you feel about MAU pricing that varies? If you are an app for schools and students, you might have 300k users in Sep-May, but 10k users in Jun-Aug. Would you feel comfortable if the cost went down during the low traffic months to a lower band, based on the 10k users? Or is that still a non-starter?

Everything that is per user is a non-starter in my book. Because the vast majority do 1-2 API calls to login once, are considered active and then never login again during the month. But you still have to pay as if it was active for the whole month. That is why per API call pricing (a la AWS S3) or resources based pricing (1 CPU) is the best.

Thanks for the feedback!

Re: Show HN: Open-Source Auth for NextJS / React

#49

Post by Abishek_Muthian »

Congratulations on the launch!

Is Ory targeted at end-user application authentication alone or is internal infrastructure identity management it's goals as well? I understand that any NextJS/React could use this, It's just identity management for internal infrastructure requires additional set of features like those offered by SAASPASS, Auth0...

P.S. I run a curated list of startup tools at https://startuptoolchain.com and I'd like to add Ory to it.

Re: Show HN: Open-Source Auth for NextJS / React

#50

Post by mjepronk »

claystraw wrote: post #12
mjepronk wrote: post #8

Earlier quoted context omitted.

Thank you for working on this interesting open source product. I have some questions: - Is it possible to have multiple organizations in one single instance? Can I have some superusers that have access to all organizations? - Can I delegate authentication for a subset of users (in my case this will always be an entire organization) to another authentication provider (say Microsoft ADFS)? - Do you support SAML 2.0 cli…

Thank you for these questions! First of all I want to say that Ory Kratos is built for customer facing authentication first, so many of the enterprise requirements (e.g. LDAP integration) are still missing. Our vision is to build the de-facto open standard for auth, so enterprise IAM is on the roadmap. It just needs time & community feedback to get there :) To answer your questions: - Is it possible to have multiple…

Thank you for your answers!

The project for which I'm most interested in a solution like Ory Kratos is a multi-tenant SAAS, with a few hundred organizations. The organizations in general already have other systems that they use to keep track of employees, and so they want to be able to interface with our system to create and deactivate (or delete) users.

So it would suffice if we could host all organizations in one instance, and that we would still be able to directly expose Ory Kratos API's to our clients without them being able to see users in other organizations.

Post reply on HN