Best Practices

Identity is the kind of system where bugs become security incidents and migrations take quarters. The patterns below keep both costs down.

Token Storage (the Most Common Mistake)

The pattern for SPAs:

1. Refresh token in httpOnly secure cookie (your backend issued).
2. Access token in memory.
3. On page load, hit /auth/refresh which uses the cookie; gets new access token; stores in memory.
4. Access token expires every 5-15 min; refresh transparently.

Auth0's @auth0/auth0-react and Clerk's @clerk/clerk-react both do this pattern automatically with their hosted backend.

Session Strategy

Pick deliberately:

For B2B with security expectations: server-side sessions with explicit revocation are common. For B2C scale: stateless JWT + rotation + short expiry is enough.

Avoid Lock-In

You probably won't migrate IdPs, but you might. Reduce coupling:

• Use OIDC SDKs, not vendor-specific ones where you can. The Auth0 SDK works against any OIDC provider.
• Don't depend on vendor-specific claims. Use the standard sub, email, name, org_id etc.
• Store your own user record keyed by IdP sub — never just rely on Auth0's user object as your "users table."
• Avoid vendor rules / actions for business logic. Webhook into your own service for custom logic.

Your own users table looks like:

CREATE TABLE users (
  id UUID PRIMARY KEY,
  external_id VARCHAR(255) UNIQUE NOT NULL,   -- IdP's sub
  external_provider VARCHAR(50) NOT NULL,      -- 'auth0' | 'clerk' | 'workos'
  email VARCHAR(255) UNIQUE NOT NULL,
  created_at TIMESTAMPTZ NOT NULL,
  ...
);

Migrating IdPs becomes "match new IdP's sub to the old external_id for each user; cut over."

Email is Identity (Carefully)

Most flows assume email uniqueness. Be deliberate:

• email should be UNIQUE and NOT NULL in your user table.
• "Sign in with Google" returns an email — match to existing user if it exists (after verification).
• Don't let email_verified=false accounts log in via password — they could squat someone else's email.
• Treat email change as a sensitive operation: re-auth, verify new email, log it.

Migration Paths

You will eventually need to migrate users between systems. Plans:

The lazy-migration pattern works because IdPs can import password hashes (bcrypt, scrypt, Argon2) — you can move passwords without forcing reset.

Observability

Most IdPs ship these to their dashboard. Pipe critical events (token reuse, lockouts, MFA failures) to your SIEM via webhooks — see ELK.

For B2B, organization-level audit logs are table stakes — customers want "show me everything users in our org did." Your IdP should provide them; if not, build them.

Rate Limiting

Auth endpoints are the highest-value attack surface in your app. Rate-limit aggressively:

• /login and /password-reset — strict per-IP and per-account limits.
• /signup — captcha or per-IP rate limit.
• /mfa/verify — per-account limit (3 attempts then lockout).
• IdP-issued tokens — built-in rate limits per audience.

Most hosted IdPs do this for you. If self-hosting Keycloak, set the brute-force detection thoroughly.

Compliance Touchpoints

Hosted IdPs include compliance controls. If self-hosting, you own all of it.

Cost Management

Watch the paid feature cliffs — Auth0's enterprise SSO, custom domain, MFA, etc. are tier-gated. Plan ahead.

Common Pitfalls

Multi-Tenant Account Linking

A user signs up with Google in Org A. Later, Org B invites them via email. They click → Org B's IdP redirects → user logs in.

The flow:

1. User accepts invitation (email → invite URL with one-time token).
2. Invite URL goes to login.
3. After login, link IdP sub to invitation.
4. User now has membership in Org B.

Auth0 Organizations, WorkOS, Clerk Organizations have this built in. Don't roll your own.

Account Deletion (GDPR Right to Erasure)

Building it from day one:

User clicks "Delete account"
  → 30-day soft-delete (recoverable)
  → after 30 days: hard delete from your DB + IdP + analytics + logs + backups
  → email confirmation at each stage

Hard but mandatory. Build it for your first GDPR-relevant user — retrofitting is painful.

Checklist