... full-stack AI apps! The Stack Monorepo: Turborepo with pnpm workspaces Web: Next.js 15 (App Router) Mobile: Expo sharing the same tRPC API API: tRPC v11 for end-to-end type safety Database & ORM: Postgres (Neon/Supabase) + Drizzle ORM Auth: Better Auth

... repeats. The team needs login, someone says "how hard can a login form be," and two quarters later they are maintaining an identity system nobody wanted to own and the actual roadmap is on fire. The problem is that auth looks like one feature but it is actually five products stacked on top of each other: Every sign-in method your users expect (passkeys alone took our team over 800 engineering hours to get production ready) Session management that survives ... ... Token infrastructure, issuance, rotation, revocation, the part that pages someone at 2am Permissions, because plain roles stop working the moment your product grows And now identity for AI agents acting on behalf of your users, which no in-house auth

... Aris, solo founder who got fed up with clunky passwords and 2FA fatigue after years of building web apps. So I created QRAuth.io , an open-source passwordless auth system where you simply scan an animated living QR code with your phone, tap once with biometrics or passkey, and you re instantly logged in. No apps, no typing, no copy-paste, it works on any website, kiosk, menu, or even physical products, and it s cryptographically signed so screenshots are useless ...

... spent 6 months paying for shortcuts you took in the first 6 weeks. The cost breakdown is not about the money. It is about the lost features you never got to build. The customers you never acquired. The competitors who passed you while you were debugging. The most expensive code is not the code that broke. It is the code that worked just well enough to keep around while it slowly drained your team's energy. Have you ever ... ... outside your team review your architecture, you are building in a vacuum. Good practice: Before writing code, draw your system on a whiteboard. Identify single points of failure. If the database goes down, does everything go down? If the auth

... dead, long live the CLI " post hit the top of Hacker News. OpenClaw, the hottest open-source agent project in the world, deliberately chose not to support it. The argument: MCP tool definitions eat your context window. Auth is clunky. The whole thing is an unnecessary abstraction over APIs that already exist. LLMs are smart enough to call APIs directly, or use CLIs, or write their own integration code. Why add a protocol layer? This sounds right ... ... engineers and agents touching production systems, terrifying. MCP creates a permission boundary that CLIs don't have. The spec mandates OAuth 2.1 for remote servers. You get user-level consent, token expiry, scoped access, audit trails. The CLI alternative

... everything backend related and next.js was for the frontend. Once we started moving out of the MVP phase, I started migrating off supabase to cloudflare completely. Now our whole backend runs on cloudflare workers. Supabase postgres -> D1. Supabase auth -> better-auth

... works first try, and you're like "I'm literally unstoppable"? Yeah, I had that. Then I actually read what I deployed. Hardcoded API keys just vibing in my frontend. SQL queries that are basically open invitations for attackers. Auth middleware that sometimes forgets to auth

... problem, what was? Then it hit me: Context loss. Every single day, I was bleeding context: The Cursor Claude Cursor cycle: [In Cursor] "We're using Zustand for state management" "Let's add React Query for server state" "Auth is handled with NextAuth.js" [Close Cursor, open Claude Desktop 3 hours later] Claude: "What state management are you using?" Me: "Uh... I think... Zustand? Or was it Redux? Wait..." [Back in Cursor next day] Cursor: "Should we use React Query ... ... today. We're building toward 10x better. And we're doing it by solving the fundamental problem: AI tools don't remember. Projects do. Where We Are Now (The Foundation): 1. Universal Platform Support Works with Claude Desktop, Cursor, VS

... nightmare from poor documentation to limited support, and zero control over email, phone, or even password-based login. The Pain Points... TikTok gives no user email or phone just a limited token that s barely usable. No password auth support, meaning no custom login experience. And if you're thinking of OpenID Connect or OAuth standards TikTok just doesn't play well with that world. The Problem (Before State) "I need to add TikTok auth

... Where do you see passwords in the future? Do you think passwords will always be around? Or are we headed to a fully passwordless Internet/world? Bonus question: what kind of biometric auth do you feel most comfortable with? Full disclosure: I'm working on a product related to passwordless auth