stack VS fusionauth-jwt

Hi HN! We're building Stack Auth (https://stack-auth.com/), an open-source managed authentication and authorization platform. Basically, we build your login and signup pages, and everything that comes with that.

You can find our customer pitch elsewhere, so instead I'll tell you more about us and the company. We are developers building for other developers, so you can think of everyone here as a devX engineer. We launched with a Show HN in April, and have been growing exponentially since.

Think of us as a fast-moving open-source infrastructure business. We spend a lot of time thinking about how we can maintain the agility of a startup while being as reliable as incumbents. Sometimes, this means new ideas; for example, we heavily rely on AI and snapshots for our E2E tests, and have API migration tooling that blows everyone else out of the water. If you have ideas like these, we want you.

We've sworn to keep a no-bullshit culture. We're all pulling on the same string; we don't keep secrets from each other and always assume good faith. We want to build the open-source cloud infrastructure of the future; we'd rather die trying than sell out for a quick buck.

We are (very) well-funded by investors such as YC, Paul Graham, Guillermo Rauch, Theo Browne, and Khosla Ventures. Our number one priority is to build an outstanding product that developers *really* love — everything else comes second.

For now, we are exclusively hiring onsite in San Francisco; sadly, we don't currently have any remote positions. Optionally, you can move with us into our hacker house (both temporarily or permanent), but you can live in your own home too.

If that sounds like a great fit, email me mentioning that you're from HN and tell me why we caught your eye: konsti (at) stack-auth.com

Thanks all!

I'm biased but Stack Auth [0] is fully open-source, self-hostable, and we offer reasonably priced managed hosting, if that floats your boat.

[0] https://github.com/stack-auth/stack

Stack Auth maintainer here. Kinda disappointed by the lack of open-source solutions in this thread — if anyone's looking for managed auth like WorkOS/Clerk/Auth0, but wants it to be 100% open-source, you should give us a go. https://github.com/stack-auth/stack

Before we dive in, I want to quickly introduce Stack Auth, the open-source authentication library we’re building. It’s designed to be super easy to set up and offers a beautiful set of UI components right out of the box! Whether you’re building a SaaS product or your next side project, Stack Auth simplifies authentication without compromising on flexibility.

Not sure about Azure ecosystem but huge fan of https://clerk.com/.

Trying out https://stack-auth.com/ which just launched on HN, mostly out of OSS solidarity

We created a SECURITY.md file on our repo, it's in the .github folder: https://github.com/stack-auth/stack/blob/dev/.github/SECURIT...

If it helps you, we delegate the most vulnerable parts of the application, such as OAuth, to lower-level frameworks — similar to the unmanaged auth libraries people use today. We are essentially a thick wrapper around those, to create a full-stack platform from primitives.

The point I disagree with is that building it yourself is better than delegating it to a third-party — at best, you can secure your auth against vulnerabilities you're aware of. Unfortunately, this fallacy keeps coming up, but generally it's the case that homebrew auth is not more secure than open-source libraries, nor is proprietary code.

If you choose the latter, there's absolutely no reliance on us; if you think we're doing a bad job at any point in time, you can export all your data and start self-hosting instead.

Also, we're more than just authentication — we have authorization built-in (permissions, teams, ...), and a frontend to manage your users (with impersonation, filtering, ...). You can use any language to access these features through our REST API [1].

We also have a bunch of components for sign in, password reset, organizations. For now, we only support Next.js frontends and backends in any language with our REST API [1], though our docs also list the client endpoints, and some people have been building frontends for other languages.

For more info, check out our GitHub repo. We're really early, but have a handful of production users already. Any feedback is highly appreciated!

Thanks all!

[0] https://stack-auth.com

[1] https://docs.stack-auth.com/rest-api/auth

[2] https://github.com/stack-auth/stack

I work for the company behind this library but not on it.

RSA is by far the most common algo needed for integrations, so I can't imagine not supporting it.

We have an open issue about supporting EDDSA (of which Ed25519 is the most likely implementation) https://github.com/FusionAuth/fusionauth-jwt/issues/13 but it hasn't gotten shipped due to other priorities.

As someone who came from Auth0 and god-awful Amazon Cognito, we've been using FusionAuth for years. Their APIs and SDKs have been amazing to work with.

https://fusionauth.io

It does what Auth0 does but significantly more cheaper and you can also self-host if you want.

I built the Pulimi plugin for it which helps us easily configure it. If you don't use Terraform or Pulumi, they have this really cool kickstart feature where you can define a config file that will call their APIs on first time startup to set up the server. Really useful for local dev.

FusionAuth is one of the most decorated and successful open-source IAM solutions. It has been downloaded by more than 10 million customers and hosts over 1 million digital identities.

Ideally, I would recommend not handling and storing passwords yourself. It is preferable to use an identity provider (IdP), such as Azure AD B2C, Auth0, or FusionAuth. These systems are designed to manage your users' identity (including their passwords) so you don't have to. You could also use Single Sign-On with cloud providers.

Check out https://fusionauth.io/

Concur.

Another data point. Our open source JWT library[0] and Java client library[1] both target Java 8 because that is widely used.

0: https://github.com/FusionAuth/fusionauth-jwt

1: https://github.com/FusionAuth/fusionauth-java-client

FusionAuth | Senior Java Engineer, Senior TechOps Engineer, Senior Support Engineer | Full-time | Denver CO, USA | https://fusionauth.io

FusionAuth is the authentication and authorization platform built for devs, by devs. Our software solves the problem of integrating essential user security without adding risk or distracting from the primary application.

Ya know, the one with the features your users want to pay you for.

FusionAuth comes without the risk and complexity that typical identity systems have. With self-hosted or cloud installation, extensive documentation, free options, fast deployment and a no-hassle process, we eliminates hurdles that make it hard for developers to meet their authentication and authorization requirements.

We aren't VC funded, but we are profitable, growing fast, and need your help. We are currently hiring for the following roles:

Senior Java Engineer

Senior TechOps Engineer

Senior Support Engineer

Learn more, including salary info, what makes us tick, and role expectations, here: https://fusionauth.io/jobs

But I rarely see a comprehensive comparison that is current for any of them. And then there are others out there like Teleport and FusionAuth.

JWT processing for java. Fast: https://github.com/skjolber/java-jwt-benchmark