Platform authentication

Last updated: Nov 4, 2026

Rationale

The Fluid Attacks platform uses Auth0, a third-party identity platform, for its authentication flows. Auth0 is the identity layer. The platform issues its own JWT tokens for API authorization.

At this time, the platform supports these identity providers through Auth0:

Google
Microsoft Azure AD
Bitbucket

Fluid Attacks selected Auth0 because of these items:

It federates authentication for all users. Thus, Fluid Attacks does not keep passwords or other sensitive user information in its database.
Clients of Fluid Attacks can easily control the access of their employees through their enterprise Microsoft Azure or Google user directories. When a client removes an employee from its user directory, the platform automatically blocks the access of that user.
With its Terraform provider, Fluid Attacks can manage all the configuration as code.
It has a >99% availability SLA.
It supports many enterprise identity providers. Thus, Fluid Attacks can support protocols like SAML, OIDC, LDAP, Azure Active Directory, Google Workspace, and more.
It has protections against bot attacks, brute force attacks, and more.
It supports many MFA factors, for example, push notifications, SMS notifications, one-time passwords, email notifications, and recovery codes.

Alternatives

These are the other authentication providers that Fluid Attacks examined before it selected Auth0. The list starts with the provider that is most interesting for the requirements of Fluid Attacks.

Stytch

Stytch gives a centralized authentication platform for applications.
It does not give other features.
Its Python library is open source and supports asynchronous environments.
It has a Terraform provider, but this provider is in beta phase at this time.
It has a >99% availability SLA, but only for enterprise plans.
It has a pricing model based on monthly active users (you pay for what you use), and it is less expensive than Auth0.
It supports many popular compliance frameworks and certifications.
It supports the most popular public identity providers.
It does not support protocols like SAML, OIDC, and LDAP.
It has protections against bot attacks, brute force attacks, and more.
It supports only SMS notifications and one-time passwords as MFA factors.

Fluid Attacks last reviewed Stytch on Jan 22, 2025.

AWS Cognito

AWS is one of the most popular cloud solution providers.
AWS gives many services, for example, cloud storage and cloud computing. This section is about AWS Cognito, an authentication solution for applications.
Its Python library is open source, but it does not support asynchronous environments. The community keeps an asynchronous fork, and Fluid Attacks uses this fork at this time.
It has a Terraform provider.
It has a >99% availability SLA.
It has a pricing model based on monthly active users (you pay for what you use), and it is less expensive than Auth0 and Stytch.
It supports many popular compliance frameworks and certifications.
It supports only Amazon, Google, Facebook, and Apple as public identity providers.
It supports SAML and OIDC.
Its protections are usually not as good as the protections of Auth0 and Stytch.
It supports only SMS notifications, email notifications, and one-time passwords as MFA factors.

Fluid Attacks last reviewed AWS Cognito on Jan 24, 2025.

Descope

Descope gives a centralized authentication platform for applications.
It does not give other features.
Its Python library is open source, but it does not seem to support asynchronous environments. Thus, Fluid Attacks cannot use it.
It has a Terraform provider, but this provider is in beta phase at this time.
It has a >99% availability SLA.
It has a pricing model based on monthly active users (you pay for what you use). It is less expensive than Auth0, but more expensive than Stytch.
It supports many popular compliance frameworks and certifications.
It supports the most popular public identity providers.
It supports SAML and OIDC.
Its protections are usually not as good as the protections of Auth0 and Stytch.
It supports only WhatsApp notifications and one-time passwords as MFA factors.

Fluid Attacks last reviewed Descope on Jan 22, 2025.

Kinde

Kinde gives a centralized authentication platform for applications.
It also gives services for user management, lead generation, and machine-to-machine connections.
Its Python library is open source, but it has almost no support and it does not seem to support asynchronous environments. Thus, Fluid Attacks cannot use it.
It does not have a Terraform provider.
It does not give information about SLAs.
It has a pricing model based on monthly active users (you pay for what you use), and it is less expensive than Auth0 and Stytch.
It supports many popular compliance frameworks and certifications.
It supports the most popular public identity providers.
It supports SAML and Azure OIDC.
Its protections are usually not as good as the protections of Auth0 and Stytch.
It supports only SMS notifications, one-time passwords, and email notifications as MFA factors.

Fluid Attacks last reviewed Kinde on Jan 22, 2025.

WorkOS

WorkOS gives SaaS solutions for requirements that enterprise applications usually have.
Because it has a wide scope, it gives services for user management, administrative portals, authentication, authorization, and more.
Its Python library includes authentication (SSO, user management, MFA) and authorization (fine-grained authorization). It also supports asynchronous environments.
It does not have a Terraform provider.
It has a >99% availability SLA.
With its pricing model, it is free for a maximum of 1 million users. Thus, it is the least expensive alternative.
It supports many popular compliance frameworks and certifications.
It supports the most popular public identity providers.
It supports SAML and OIDC.
It has protections against bot attacks, brute force attacks, and more.
It supports only one-time passwords as an MFA factor.

Fluid Attacks last reviewed WorkOS on Jan 22, 2025.

Usage

Fluid Attacks uses Auth0 for all authentication flows in the Fluid Attacks platform. Fluid Attacks manages the tenant configuration as code with Terraform in the integrates/infra directory.