Don't Shop for Auth. Diagnose It.

Two products. Same instinct both times. Opposite auth tools - and both were the right call.

One was an NGO: small team, light login needs, no multi-tenant anything on the roadmap. Django AllAuth. Configured in a day. Still running.

The other was a SaaS startup where auth wasn't a login screen - it was half the product surface. Impersonation, org-scoped invites, role-based access on the near-term roadmap, not parked under "someday." That one needed an identity provider, a migration off hand-rolled Google OAuth, and real focus. Weeks, not an afternoon.

The difference wasn't taste. It was scale - of the requirements, and of the effort those requirements force. One product needed authentication. The other needed identity as a system. Treating those as the same shopping trip is how teams overbuild for problems they don't have, or underbuild for the ones already on the calendar.

Here's the actual point of this post: the tool comes last. Requirements first, category second, specific vendor after that. Skip the order and you're comparing libraries against a problem that isn't a library problem - or buying an identity platform for a site that needed a checkbox.

I wrote up both decisions - the six questions that separated them, the migration, the rough edges on each side. Full case study: https://tinthe.dev/case-study-auth-tool-last