Authentication

How each backend-as-a-service platform handles user authentication.

Supabase

Ships a built-in Auth service (GoTrue) supporting email/password, magic links, OAuth social providers, and phone auth, with users stored in a regular Postgres table and access controlled via row-level security policies.

Firebase

Firebase Authentication supports email/password, phone auth, and a wide range of OAuth providers, tightly integrated with Firestore’s security rules for controlling per-document access based on the authenticated user.

Appwrite

Ships built-in authentication supporting email/password, magic URLs, phone auth, and many OAuth providers, with permissions configurable per-document or per-collection.

Convex

Doesn’t ship its own identity provider — it integrates with external auth providers (like Clerk or Auth0) that issue a token Convex functions can verify, rather than managing user credentials itself.

PocketBase

Ships built-in auth out of the box, including email/password and OAuth2 providers, managed through the same single executable and admin UI as the rest of the backend.

Nhost

Ships built-in authentication supporting email/password and OAuth providers, issuing JWTs that Hasura’s permission system uses directly to authorize GraphQL queries and mutations per role.

AWS Amplify

Uses Amazon Cognito for authentication, supporting user pools, social/OAuth sign-in, and multi-factor auth, integrated with Amplify’s generated frontend libraries.

Hasura

Has no built-in identity provider — it expects an external auth service to issue a JWT with custom claims, which Hasura then uses to enforce its role-based permission rules on every GraphQL request.