Agent WranglersSign-in methods Recommended
Decide whether a provider or a library runs sign-in
Choose a hosted identity provider or a maintained library on purpose, write down why, and never write your own password, token or protocol code.
How to do it
Pick a hosted provider, such as Auth0, Clerk, Amazon Cognito or Microsoft Entra External ID, when you need business single sign-on or SCIM soon. Pick a self-hosted server, such as Keycloak or Ory, when data must stay on your own servers. Pick a library, such as Auth.js, Better Auth, Django allauth or Spring Security, when sign-in is simple. Before choosing, confirm you can export every user, including password hashes, and leave. Write the choice and the exit plan in the project's decision log.
How to check
Search the code for hand-made password hashing, token signing or SAML parsing, such as createHmac or hashlib.sha256 near the word password. Nothing appears outside the chosen library. The decision log names the choice and the export path.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/sign-in-methods/auth-provider-or-library.