身份认证：为 SaaS 选择默认方案与例外条件

Recommendation

新 SaaS 默认优先 Clerk；要求数据控制或自托管时选择 Better Auth；企业 SSO 与目录同步迫近时评估 WorkOS。

先判断你是否需要最快的托管体验、应用自有身份数据，还是企业 SSO 的独立能力。¹ ²

适用范围： New SaaS applications using a supported web framework and preferring managed authentication

Main trade-off

更快的预置界面和 SDK 往往意味着更深的平台绑定与用量定价依赖。¹

这些条件说明何时该从这里开始，而不是把选择当作通用排名。

Short path to production: First-party framework guidance and prebuilt flows reduce integration work.¹ ²

Managed identity state: Users, sessions, account linking, MFA, and recovery are operated as a service.¹

Product-ready interfaces: Hosted and component-based account interfaces avoid rebuilding standard identity UI.¹

这些条件会改变默认答案；请在作出承诺前逐项验证。

Choose it when authentication must run in infrastructure your team controls.

Main trade-off: You assume more security, persistence, and operational responsibility.³

Choose it when enterprise SSO and directory workflows drive the buying decision.

Main trade-off: The fit is more enterprise-identity-specific than the general SaaS default.⁴

Choose it when the product already commits to Supabase and needs conventional authentication.

Main trade-off: Ecosystem alignment leads the decision more than the account experience.⁵

官方文档与继续决策的正式路径。

支撑页面关键主张的资料。