Clerk vs Next-Auth.js | It's not that simple...

Summary

This video explores the decision-making process for implementing authentication in a SaaS application. It weighs the pros and cons of using a hosted provider like Clerk or Auth0 versus a self-hosted solution like Next.js Auth. The choice depends on the business model and user base: for simple B2C applications with few paying users, Next.js Auth is recommended to avoid high costs. However, for B2B applications with enterprise customers, a hosted provider is preferable due to the advanced features and reduced development time. The video also addresses the potential risks and costs associated with changing pricing models and the complexities of building and maintaining a custom authentication layer.

Takeaways

• 🤔 The choice between using a hosted SaaS provider for authentication or building your own with a library like Next.js is not straightforward and depends on the specific use case and business model.
• 🔒 For simple applications requiring basic authentication, using an open-source, self-hosted solution like Next.js is recommended to avoid the costs associated with hosted providers.
• 💰 Hosted providers like Clerk or Auth0 can be cost-prohibitive for applications where not all users pay for the service, as their pricing can be high and may not provide enough return on investment.
• 🏢 For B2B SaaS applications with enterprise customers, a hosted provider is often preferable due to the need for advanced features like SSO, MFA, and robust organization management that may be time-consuming or complex to build from scratch.
• 🛠 Building your own authentication layer with Next.js can be time-consuming, requiring the development of user interfaces, error handling, and complex logic that comes pre-built with hosted solutions.
• ⏱️ Implementing authentication with a hosted provider can be significantly faster, potentially taking as little as 15-20 minutes, compared to the hours or more required for a custom solution.
• 💡 The decision to use a hosted provider or build your own should consider the potential savings in development time and the costs associated with maintaining a custom solution.
• 📈 For B2B applications where most users are paying customers, the small fees charged by hosted providers may be negligible compared to the value they bring in terms of features and ease of use.
• 📊 The potential for unexpected price increases from hosted providers is a risk, and businesses should consider the impact of such changes on their cost structure.
• 🛑 If a hosted provider significantly raises their prices, businesses may need to consider migrating to a different provider or building their own solution, which involves a significant investment of time and resources.
• 📝 Compliance with regulations like GDPR is a consideration for both hosted and self-hosted solutions, and businesses must ensure they can meet these requirements regardless of the authentication method chosen.

Q & A

What is the main topic discussed in the video script?

The main topic discussed in the video script is the decision-making process for choosing between using a hosted SaaS authentication provider or building your own authentication system using a library like NextAuth for a SaaS application.

What are the two options presented for implementing authentication in a SaaS application?

The two options presented are using a hosted SaaS provider like Clerk or Auth0, or building your own authentication using an open-source library like NextAuth.

What factors should be considered when choosing between a hosted provider or building your own authentication system?

Factors to consider include the complexity of the application, the business model (B2B vs B2C), the need for advanced features like SSO and MFA, the cost of the hosted service, and the potential for scalability and maintenance.

Why might a simple application with basic authentication needs be better off using NextAuth instead of a hosted provider?

A simple application might benefit from using NextAuth because the cost of a hosted provider could be disproportionately high compared to the revenue generated by users, especially if not all users are paying customers.

What are some of the advanced features that might be needed for a B2B SaaS application?

Advanced features for a B2B SaaS application might include Single Sign-On (SSO), Multi-Factor Authentication (MFA), and a robust organization layer for managing different user roles within an enterprise.

What is the potential downside of using a hosted authentication provider for a B2B SaaS application?

The potential downside is the cost associated with using a hosted provider, which can increase significantly if the pricing model changes, and the time and effort required to migrate to a different provider or build your own system if needed.

Why is building your own authentication layer time-consuming and complex?

Building your own authentication layer is time-consuming and complex because it requires developing and maintaining custom UI elements, handling form errors, implementing security measures, and ensuring compliance with regulations like GDPR.

What are some of the benefits of using a hosted authentication provider like Clerk or Auth0?

Benefits include ease of implementation, automatic error handling, built-in security features, and the ability to quickly add advanced authentication features without extensive development work.

What is the importance of considering the cost per user when deciding between a hosted provider and building your own authentication system?

The cost per user is important because it helps determine if the investment in a hosted provider is justified by the revenue generated by each user. It's a key factor in calculating the return on investment for the authentication solution.

How does the script suggest approaching the decision if a hosted provider significantly increases its prices?

The script suggests considering migration to a different provider or building your own authentication system if the price increase is substantial and affects the business's bottom line.

What is the script's final recommendation for a B2B SaaS application where most users are paying customers?

The script recommends using a hosted provider for a B2B SaaS application with paying customers, as the benefits in terms of time saved, ease of use, and advanced features usually outweigh the costs.

Outlines

00:00

🤔 Choosing Between Hosted and Self-Hosted Auth Solutions

This paragraph discusses the dilemma of selecting between a hosted or self-hosted authentication solution for a SAS application. It highlights that the decision is not straightforward and depends on various factors such as the business's use case, state, and application structure. The speaker suggests using Next.js for simple applications requiring basic authentication, as it avoids the costs associated with hosted providers like Clerk or Auth0. However, for B2B applications with enterprise customers, the paragraph leans towards using a hosted provider due to the need for advanced features like SSO and organization management, which are more complex to implement with self-hosted solutions.

05:01

🛠 Building vs. Using Hosted Auth for Complex Applications

The second paragraph delves into the complexities of building your own authentication layer versus using a hosted solution. It emphasizes the time-consuming and resource-intensive nature of creating custom UIs, handling form errors, and managing authentication logic with self-hosted options like Next.js. In contrast, hosted solutions such as Clerk, Auth0, and others offer ready-made sign-up pages and automatic error handling, significantly reducing the development time and effort. The speaker also touches on the potential risks of relying on hosted providers, such as sudden price increases, and the challenges of migrating to an alternative provider or building a custom solution from scratch.

10:03

💡 Deciding Factors for Auth Solution Based on Business Model

The final paragraph wraps up the discussion by summarizing the key considerations for choosing an authentication solution based on the business model. For B2C applications where not all users contribute revenue, Next.js is recommended for its simplicity and cost-effectiveness. Conversely, for B2B applications where users are likely to pay for the service, the paragraph advocates for hosted solutions despite the associated costs, due to the time and effort saved in development and maintenance. The speaker shares personal experience, noting the challenges of scaling a self-hosted authentication layer and the potential compliance issues that may arise with enterprise-level applications.

Keywords

💡SaaS application

A Software as a Service (SaaS) application refers to a software application that is delivered over the internet as a service. In the context of the video, the speaker is discussing the implementation of authentication for a SaaS application, which is a critical component for user access and security.

💡Hosted SaaS provider

A hosted SaaS provider is a service that offers SaaS applications over the internet. Examples given in the script include Clerk and Auth0. The speaker compares these to self-hosted solutions, discussing the pros and cons of using a third-party for authentication services in a SaaS model.

💡Next.js Auth

Next.js Auth is an open-source library used for implementing authentication in Next.js applications. The script mentions it as an alternative to hosted providers, suggesting that for simple applications, Next.js Auth might be a more cost-effective solution due to its self-hosted nature.

💡Basic authentication

Basic authentication is a simple method of identifying users by requiring a username and password, often used in conjunction with social logins like GitHub, as mentioned in the script. It is the most straightforward form of authentication and is suitable for applications with minimal security requirements.

💡SSO (Single Sign-On)

SSO is an authentication process that allows a user to access multiple applications with one set of login credentials. The script discusses the necessity of SSO for enterprise customers, indicating that hosted providers like Clerk or Auth0 offer this feature, which may not be as easily implemented with self-hosted solutions.

💡Enterprise customers

Enterprise customers are businesses or organizations that purchase products or services for use within their company. The video script emphasizes that for B2B SaaS applications with enterprise customers, using a hosted SaaS provider is recommended due to the need for advanced features like SSO and robust authorization systems.

💡Authorization

Authorization is the process of giving users permission to access certain resources or perform certain actions within a system. The script explains that for complex applications, especially those serving enterprise customers, a good authorization layer is crucial, and this can be more efficiently provided by hosted providers.

💡Multi-factor authentication (MFA)

MFA is a security method that requires more than one method of authentication from independent categories of credentials to verify the user's identity for a login or other transaction. The script suggests that implementing MFA can be complex with self-hosted solutions like Next.js Auth, and it might be more practical to use hosted providers for this feature.

💡B2B SaaS

B2B SaaS stands for Business-to-Business Software as a Service. The script discusses that for B2B applications, where customers are other businesses, the use of a hosted provider might be more beneficial due to the need for features like SSO, MFA, and advanced authorization that these businesses expect.

💡Cost

In the context of the script, cost refers to the expenses associated with using either a hosted SaaS provider or building and maintaining a self-hosted authentication system. The speaker discusses how the cost can be a determining factor in choosing between these options, especially considering the potential for high prices or unexpected price increases from hosted providers.

💡Regulation compliance

Regulation compliance refers to the adherence to laws and regulations, such as GDPR for data protection. The script mentions that building your own authentication layer with Next.js Auth requires ensuring compliance with such regulations, which can be a complex and time-consuming task, suggesting that hosted providers may offer a more straightforward path to compliance.

Highlights

When building a SAS application, the choice between a hosted SAS provider or a self-hosted solution like Next.js depends on the specific use case and business state.

For simple applications requiring basic authentication, using an open-source solution like Next.js is recommended over hosted providers due to cost-effectiveness.

Hosted providers such as Clerk or Auth0 may incur high costs that are not justified if not all users are paying for the service.

For B2B SaaS applications with enterprise customers, a hosted provider is advised to access advanced features like SSO and organization management.

Building your own authentication layer with Next.js can be time-consuming and complex, especially when compared to the ease of using hosted services.

Hosted services like Clerk or Auth0 provide ready-to-use features such as sign-up pages, error handling, and connection to authentication methods.

The decision to use a hosted provider should consider the potential cost implications and the value of time saved in development.

Enterprise customers expect a robust authentication system, which might be challenging to build and maintain with self-hosted solutions.

The potential for sudden price increases with hosted providers presents a risk that businesses need to evaluate.

Migration from one provider to another or building a custom solution can be a difficult decision, especially after significant price hikes.

The need for compliance with regulations like GDPR adds another layer of complexity to self-hosted authentication solutions.

B2C applications where most users do not pay for the service may benefit from the simplicity and lower costs of Next.js.

B2B applications with paying users can justify the use of hosted providers for the convenience and advanced features they offer.

The trade-off between saving on authentication costs and investing time and resources into building a custom solution must be carefully weighed.

Maintenance and error handling are ongoing considerations for businesses that choose to implement their own authentication layer.

The speaker's personal experience suggests that building a custom authentication layer for a growing business can be challenging and not as fun as expected.

The video aims to help viewers understand the pros and cons of both hosted and self-hosted authentication options to make an informed decision.

Transcripts

so let's imagine the following you're in

the position where you are building

currently a SAS application and now

you're at the step where you have to

implement off and now you have two

options either use a hosted um SAS

provider like for example Clerk or off

zero or work Os or you roll your own off

using a library like next off and now

the question comes which one should you

use and it's not an easy question to

answer since both um providers or both

options in that sense have Pros cons

caveats or you could say the answer is a

double-sided knife because there's no

white or wrong answer it depends on your

use case on your business State um how

your application is built Etc but after

this video you'll actually understand

what option is the right one for which

business use case so now let's roll the

video so let's talk about the use case

first of all so let's say you're

building a very simple application where

all you need is basic authentication

that means o off using for example

GitHub and then maybe also magic links

something like that and now what should

you use in that case so it's very simple

you don't need no account linking

Enterprise off um organizations you

don't need it all you need is basic off

and then I guess uh authorization using

your database um in that case you should

actually use next off forget about

anything that's hosted so in that sense

Clerk or zero work OS OCTA whatever you

uh know don't use it use next off use

something open source and uh selfhosted

why is that because if you're building

something so simple there's a pretty

high probability that not every user

that you onboard pays for your service

because if it's that case that where you

have for example 10,000 users and from

those 10,000 users maybe 10 50 100

people only pay for your service I would

actually say it's not uh very good to

use an hosted provider why is that well

an hosted provider like Clerk of zero or

work OS has of course a cost behind it

you pay to use the services which is

normal right and the problem is that

these prices can be quite high so if you

have an application where not every user

pays for your service it will be

actually not not good expense for you

because you pay way too much but get uh

not enough in which return for what you

pay but now let's take the following you

have a B2B SS and you have Enterprise

customers so for example you have Google

as your own customer imagine that in

that case forget next off just forget it

uh get it out of your mind forget it in

that case I would use a hosted s

provider so Clerk of zero or work OS why

is that well because you will actually

need features that you don't get using

next off or which you can get but have

to build on your own and which will take

a lot of time so if you have Enterprise

customers you for example need SSO you

can get that using next off but it will

be I don't know is it simple it's not

quite simple but you can do it but I

wouldn't suggest that also if you have

uh a B2B SS you'll actually have to need

to create organizations think about like

that you have a company right company

ABC this company has a CEO managing

director whatever and then you have Alo

the normal in quotations workers which

have normal roles right and the same is

also for your application if you have a

B2B application which is a multi-tenant

application for example and you have an

organization which you want to onboard

to your application you will have to

have a pretty good um organization layer

on your off layer which means if you're

on board a company a organization what

you have to do is a good authorization

system where the admin the CEO for for

example can actually choose other admins

and other members so what I mean with

that is you need a good authorization

layer in that sense um that not every

user which is in a organization can do

everything so you need for example

different roles for different users in

your organization you can do that using

next off it's doable I uh I did it

myself it's fine you can do it I

wouldn't do it actually because why

should you if you think about it you

have a B2B says in most cases that means

that every user that comes to your

application also pays for your

application and if that happens then the

question comes why should I even bother

building it uh on myself why should I

bother implementing MFA so multifactor

off which is not uh so easy next off why

should I bother uh creating this whole

organization layer um uh authorization

layer why should I Bor even actually um

do everything like that why should I

right uh right if every user that comes

and pays for my service it would just be

much uh simpler another thing is if you

actually opt in to use next off and

actually build your own off layer the

problem is that you actually also have

to build U the UI for that so in that

sense you have to build the sign up page

the login page the forget password page

you have to handle form errors uh you

have to handle the whole logic you have

to do a lot of things to make it work

the thing is with Clerk of zero and work

OSS is that you actually can use the

hosted um sign up pages and the nice

thing with that is everything is done

for you automatically error handling uh

checks for password um this whole

connection to O offs and magic links

everything is done for you and at the

end of the day is if you use for example

a hosted application you can make off

work in I don't know 15 minutes 20

minutes if you're not the fastest which

is also fine but if you use the next off

as your authentication layer my man you

will have to I don't know 12 hours 13 14

15 30 50 I don't know um how complex

your applications but the more complex

your application becomes the harder it

becomes uh to achieve this using a open-

source authentication layer that means

if it's something very simple and you

don't need anything uh which is complex

then don't bother using next uh uh clerk

any your host the provider but if you're

looking at actually creating something

complex with authorization uh

organizations multiactor off SSO I don't

know something that you really don't

want to build your on your own hey

forget next off use something hosted why

should you use something uh why should

you build it on your uh by yourself if

there's something like that but that's

if you think about it in a deaf uh mind

in a deaf environment I guess but let's

say you're a business owner what do you

do now because at the end of the day if

you use a host provider a host that says

like Clerk of zero work OS there's of

course a cost associated with it and for

example the problem is for example um I

think yesterday or the day before I

can't quite remember um of zero made a

Blog article where they said um that

they have changed their pricing to be

more accessible or some I don't know

marketing stuff like that at the end of

the day what they really did is increase

your prices by

300% again 3 0 Z 3 100% increase imagine

you pay $1,000 a month for off zero now

you pay $3,000 uh a month just from

today to Tomorrow there's such an

increase out of nowhere and now imagine

you have 10,000 users inside of your off

zero database what do you do now do you

just say yeah fine okay I will pay this

300% increase it is what it is or do you

say I migrate off and build all of this

nasty uh stuff uh by myself and well

that's hard question to answer and I

can't answer it for you it's not that

simple as said you have two options you

either migrate to a different provider

like clerk work Os or you go and build

it by yourself and now the thing is if

you build it by yourself you will have

to waste or not waste I guess but you

have to take a lot of hours to build

what you have using this hosted provider

you have to build authorization you have

to build um I guess this whole

multiactor off if you need it the

organization layer you have to build

build everything by yourself and it

takes a lot of time a lot of uh a lot of

money actually because you have to pay

your employees for that it's not that

simple but let me summarize it like that

if you have a B2B application so you

have a busines to business application

where each user or Mo or let's say

almost every user that you on board pays

for your service then just pay the fee I

mean God what is it 5 Cent 6 Cent per

user then just pay it if your user

brings in $100 a month and you have to

pay I don't know 10 cents a month to

your off provider then do it I mean the

headache that you will have from

building your own off layer or your own

Enterprise off layer is way bigger than

if you try to use an hosted provider and

don't even uh get me started on if you

actually become an Enterprise you'll

have even more problems using your own

off layer why is that because well you

have to actually also somehow achieve um

certain security risks right or not a

aieve them but prevent them and for that

you will have to actually get certified

etc etc you probably already saw that

always if you scroll down to the website

there's this whole gdpr or whatever that

is uh you have to be compliant to

certain regulation and the thing is you

can achieve that using next off you can

do that that's fine do you want to do

that that's the real question do you

really want to do that I don't know I

wouldn't so what I would say is if your

application is basic b2c not every user

brings in money or actually most users

don't bring any money and all you want

is actually just to authorize them then

just use next off forget it but let's

say you build a B2B s where every user

brings in money uh pays to use your

service then use clerk I mean really who

cares man this 5 cents 6 cents sure you

could save them using uh building your

own off layer but it's still a

double-sided knife because you think oh

yeah I can save that much money but in

the same case or in that but in the

still in the same time you actually have

to pay using a different method and

that's time building your own off layer

takes huge amounts of time you have to

actually maintain it you have to handle

errors it's not easy so if it's a B2B

says use something hosted it will save

you a lot of headaches I talk from

experience I have tried to build my own

authentication layer and scale it to a

bigger size it it wasn't fun I was will

tell it like that but um if you are

bullying something simple forget about

Clerk or anything like that but now I

hope I could actually help you and try

to understand the both options and what

pros and cons we have because at the end

of the day it's not an easy option to

choose and that's also not a right or

wrong option it is what it is you choose

what you choose and it will have Pros it

will have cons um so yeah I hope you

enjoyed this video and I hope I will see

you on the next video which will drop in

a few days so now bye