HACKER Q&A
📣 andrewstuart

User signup with OAuth has become insanely complex – is it needed?


You can have a simple email based signup/signin system - I'm pretty sure most users know how to drive this ok.

Your application won't be too complex - it's reasonable to implement from a development perspective.

OR

You can go down the path of oauth using various "Login With" systems such as "Login with Google". And if you do this then your development complexity just went through the roof - god forbid that you should expand to multiple providers.

So how much does it really matter to provide third party "Sign in with Google/Twitter/Microsoft whatever"?

Is it just crazy featuritis in which "gotta collect em all, gotta do all the things" style of development?

Only having email based signup no doubnt will result in developers and stakeholders tut-tutting "Well we will lose users if we don;t provide ever possible way to sign up/sign in!". But is that really true? If users want to use your system won't they just use email signup/signin?

BTW I do understand that your application may need to use the APIs of that provider, in which case it is unavoidable of course.


  👤 leros Accepted Answer ✓
It's not that complicated. You should not be implementing OAuth from scratch.

I don't roll my own auth. I use things like Firebase Auth for free sites or Auth0 for paid sites. Adding extra auth mechanisms is trivial using those tools.

If I was rolling my own auth, I would implement email and Google using something like passport.js. It's really not that difficult.