SaaS PlatformBy Abdul Rahman17 Jun 20263 min read
Authentication for Modern SaaS: OAuth 2.1, SSO and Passkeys
Passwords alone are no longer enough for B2B software. A practical guide to OAuth 2.1, enterprise SSO, passkeys, and session design for multi-tenant SaaS.
Authentication has become a buying criterion for SaaS. Small teams expect social login and passwordless options; enterprise customers expect single sign-on before they'll sign a contract. Getting identity right early saves painful migrations later.
The access token never passes through the browser's address bar, and PKCE protects the code exchange.
OAuth 2.1 and OpenID Connect in Brief
OAuth is an authorisation framework: it lets an application obtain limited access on a user's behalf. OpenID Connect (OIDC) adds an identity layer on top, so the application also learns who signed in.
OAuth 2.1 consolidates years of best practice into one specification. The practical changes:
- The authorization code flow with PKCE is required for all clients, including server-side apps.
- The implicit flow and the password grant are removed.
- Redirect URIs must match exactly.
If you use a reputable auth provider or library, you get these defaults for free — which is a strong argument against writing OAuth handling yourself.
Enterprise SSO
Larger customers want employees to sign in with their corporate identity provider, such as Microsoft Entra ID, Okta or Google Workspace. That usually means supporting SAML 2.0 or OIDC, plus:
- Domain verification — prove a customer owns
company.combefore routing those users to their IdP. - Just-in-time provisioning — create the user on first SSO login.
- SCIM — let the customer's IT team create and deactivate users automatically.
For a multi-tenant product, SSO configuration belongs to the tenant, not the user: one organisation, one identity connection.
Passkeys: Phishing-Resistant by Design
Passkeys replace passwords with public-key cryptography built on WebAuthn. The private key never leaves the user's device, and the credential is bound to your domain — which makes phishing structurally ineffective.
For SaaS teams the benefits are concrete: fewer password resets, no credential-stuffing attacks, and a faster sign-in on mobile. Offer passkeys alongside existing methods and let users opt in.
Magic Links and Passwordless Email
Email magic links are a pragmatic middle ground for internal tools and admin panels — the admin area of this portfolio uses one. Keep links single-use and short-lived, bind them to the browser that requested them where possible, and rate-limit requests to prevent abuse.
Session Design
Authentication is only half the story; sessions carry identity for every subsequent request.
- Short-lived access tokens with rotating refresh tokens for APIs and mobile apps.
- HTTP-only, Secure, SameSite cookies for browser sessions — never store tokens in
localStorage. - Server-side revocation so admins can sign out a compromised account immediately.
- Tenant context in the session, so every request is scoped correctly.
cookies().set("session", token, {
httpOnly: true,
secure: true,
sameSite: "lax",
maxAge: 60 * 60 * 8, // 8 hours
});
Build or Buy?
Identity is security-critical and full of edge cases. For most teams, a managed provider (Auth0, Clerk, Supabase Auth, Cognito and similar) is the right call; build only the parts that are core to your product, such as roles and tenant permissions.
Key Takeaways
- Use the authorization code flow with PKCE; avoid deprecated OAuth flows.
- Plan for enterprise SSO (SAML/OIDC) and SCIM at the tenant level.
- Offer passkeys for phishing-resistant sign-in.
- Keep sessions in HTTP-only cookies with short-lived tokens and server-side revocation.
