Uriah David

Every fast-growing company seems to have the same quiet migration story. They picked an auth tool early because it was fast to set up, free enough that nobody really had to think about it, and honestly, it was probably the right call at the time. Nobody is evaluating whether a login system can survive an enterprise deal when they are 10 people and just trying to ship the product.

Then the growth actually happens. The company gets to 50 employees, maybe starts selling to bigger customers, and the first serious enterprise prospect sends back a procurement checklist with SSO sitting somewhere near the top, non-negotiable. That is usually when you realise SSO lives on a tier that costs more than the entire tool used to cost you, or in some cases is not even available anywhere near the plan you are already three years deep into. So now you have a migration project nobody planned for, timed exactly when the company can least afford the distraction. And auth migrations are not exactly like swapping out an analytics tool. They touch active sessions, integrations built against the old system, login flows, permissions, and every customer already using the product, all while the deal that triggered the panic is still sitting in procurement waiting for an answer.

I don't really think this is a story about any one vendor being careless. It feels more structural than that. Tools built to be generous and fast at the small end tend to hit a hard ceiling right when a company starts needing enterprise features. And tools built enterprise-ready from day one usually come with an onboarding process and cost that a five-person team has absolutely no reason to take on early. There is a weird gap in the middle where very few products seem designed around the assumption that the same company might actually grow from one end to the other while staying on the same stack.

Has your team already hit that wall, or are you still early enough to see it coming before it costs you a deal?

most teams spend a lot of time thinking about user authentication. who can log in, how, with what credentials.

and then the services behind the scenes just... trust each other. because they're on the same network. because they're in the same VPC. because nobody questioned it when the architecture was first drawn up.

Passkeys are objectively better than passwords.

Phishing-resistant, nothing to forget, nothing to breach, no password database to leak. the case for them is pretty airtight. and yet most products still default to email and password. most users have never set up a passkey. most developers have never shipped one.