Comment by mvkel

17 hours ago

Start any greenfield project, hand-coded auth takes up 50% of the development time of the entire MVP

I would disagree here. You probably need OAuth with popular social services and implement username, password or OTP-based auth overall. For an MVP, you don't need to care about more details beyond this; it is hardly 10% of the entire effort, if not 5%.

I feel seen. It's compounded if you also need to add HIPAA row-level security compliance that spans to every form of resource.

It takes like an hour. So that's a quick mvp then

  • Social logins, email logins, password resets, multi-tenant, organizations, many to many users to organizations, etc etc. Not necessary for MVP, but can definitely be painful hacking in later if the MVP hits.

    • What you are talking about is in a large part authentication. You can do authentication using an external service and still have your user table locally. You can also do authorization locally with a local session table while leaving authentication to a SaaS.

    • Social logins, multi-tenant and organizations are very far from table-stakes for an MVP.

      Whether it's painful to put in later or not is sadly nothing that the managers and executives concern themselves with.

      1 reply →