---
title: "Decide whether a provider or a library · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/sign-in-methods/auth-provider-or-library
updated: 2026-10-20
licence: "All rights reserved"
---

# Decide whether a provider or a library runs sign-in

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Sign-in methods](https://agentwranglers.se/playbook/accounts/sign-in-methods)
- Rule: Choose a hosted identity provider or a maintained library on purpose, write down why, and never write your own password, token or protocol code.
- How: Pick a hosted provider, such as Auth0, Clerk, Amazon Cognito or Microsoft Entra External ID, when you need business single sign-on or SCIM soon. Pick a self-hosted server, such as Keycloak or Ory, when data must stay on your own servers. Pick a library, such as Auth.js, Better Auth, Django allauth or Spring Security, when sign-in is simple. Before choosing, confirm you can export every user, including password hashes, and leave. Write the choice and the exit plan in the project's decision log.
- Check: Search the code for hand-made password hashing, token signing or SAML parsing, such as `createHmac` or `hashlib.sha256` near the word password. Nothing appears outside the chosen library. The decision log names the choice and the export path.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/sign-in-methods/auth-provider-or-library`.

- Next: [Keep your own user ID](https://agentwranglers.se/playbook/accounts/sign-in-methods/own-user-id)
- [Sign-in methods](https://agentwranglers.se/playbook/accounts/sign-in-methods)