身份认证:为 SaaS 选择默认方案与例外条件
决定应用如何完成登录、会话、账号恢复与组织入口,不把认证和授权混为一谈。
- 默认方向
- 新 SaaS 默认优先 Clerk;要求数据控制或自托管时选择 Better Auth;企业 SSO 与目录同步迫近时评估 WorkOS。
开发者决策索引
Starter Wiki 把任务、默认路线、替代方案和 Starter Stack 放到同一条决策路径里,帮助团队更快做出可解释的技术选择。
任务→默认路线→替代方案→Starter Stack
从这里开始
决定应用如何完成登录、会话、账号恢复与组织入口,不把认证和授权混为一谈。
先确定卖方和税务责任,再选择支付处理商、Merchant of Record 或平台支付路线。
按数据模型、完整性、恢复与运维要求选择系统记录,而非先选热门后端平台。
比较框架集成、预览、后台进程、网络、区域和操作责任。
Choose a provider and operating model for application-triggered email without confusing delivery infrastructure with marketing automation.
比较模型质量、工具调用、延迟、价格、数据政策和生命周期风险。
决策地图
覆盖认证、授权、企业 SSO、组织模型和用户生命周期,重点是明确身份边界由谁拥有。
从数据库、对象存储、检索和缓存开始,把数据形态与运维责任放在同一张决策图里。
覆盖 Hosting、Serverless、CDN 与容器平台,帮助团队按运行边界而不是品牌声量选择。
把支付处理、订阅、税务、发票和 Merchant of Record 放在业务模型而非结账组件的层面判断。
邮件、通知与实时沟通有不同的可靠性、合规和产品边界。
覆盖 LLM API、SDK、路由、Agent 与嵌入;关注产品任务的可测质量,而非模型排行榜。
从错误、性能、日志和产品行为中建立可操作的反馈回路。
覆盖密钥、访问控制、应用保护与合规准备,避免把安全当成勾选清单。
CMS、后台、搜索和功能管理都应从产品运营方式出发。
覆盖测试、CI/CD、代码质量和开发者效率,重点是缩短可靠反馈周期。
Working combinations
Use this Stack when AI is a product capability inside a conventional SaaS system rather than a standalone model-research platform.
The stack accelerates product delivery but combines identity, database, billing, model, SDK, and hosting dependencies whose usage costs and failure modes must be measured independently.
Use this Stack when customer organizations, enterprise federation, provisioning, operational workflows, and account-level billing are core product requirements.
The stack covers common enterprise SaaS infrastructure quickly, but the team must own cross-system identity mapping, tenant isolation, authorization, event consistency, enterprise support, and vendor migration.
Use this Stack when editors need a managed structured-content system and the product needs a custom Next.js frontend, dedicated search, global delivery, and managed deployment.
The Stack accelerates content operations and delivery but distributes data, indexing, cache, and runtime state across managed providers whose usage, failure, and migration boundaries must be operated deliberately.
Use this Stack when a small team wants a conventional SaaS foundation, prefers application-owned authentication, and values outsourcing seller-of-record operations.
The stack can be economical and portable at small scale, but the developer assumes more authentication and integration responsibility and must validate runtime compatibility, MoR eligibility, database behavior, and migration paths.
Use this Stack when the product needs application authentication, relational data, card payments, transactional email, and managed web deployment without operating each subsystem.
The stack minimizes initial operations but concentrates product risk across several managed vendors and leaves the application responsible for domain data, authorization, tax scope, and migration planning.
Selected evaluations
Clerk is the strongest general default for a new SaaS team that values a short path to polished authentication more than infrastructure ownership.Read evaluation
Choose Better Auth when owning the authentication runtime, schema, and data is a requirement rather than an implementation preference.Read evaluation
Choose Stripe when direct payment infrastructure, subscriptions, or platform payments are intentional and the business will own the remaining merchant operations.Read evaluation
Choose Paddle when its eligibility, seller role, checkout, payout, tax, and contract model fit and reduced merchant operations outweigh lower platform control.Read evaluation
Choose Supabase when PostgreSQL, Auth, Storage, Realtime, and generated APIs belong in one coherent backend boundary.Read evaluation
Choose Neon when PostgreSQL compatibility, database branching, and elastic or suspendable compute align with the development workflow and workload.Read evaluation
Choose Vercel when framework-aware deployment, previews, and managed web delivery materially reduce team effort.Read evaluation
Choose Cloudflare when its edge runtime and integrated delivery, security, and data products match the application's execution and locality model.Read evaluation
Choose Resend when a compact developer API is the priority and the team can own consent, domain authentication, reputation, suppression, failure handling, and provider concentration.Read evaluation
Choose PostHog when suite consolidation is intentional and the team can govern identity, event taxonomy, replay capture, flag requests, retention, regions, and separate product meters.Read evaluation
Choose Sentry when application error triage is the leading job and the team can own SDK, release, source-map or symbol, sampling, and sensitive-data configuration.Read evaluation
Choose AI SDK when a TypeScript product benefits from shared application primitives and its supported provider adapters.Read evaluation
Editorial standard
A practical starting point when one route fits the common case.
The conditions that should move you away from the default.
Important claims trace back to current, reliable documentation.