Why Auth Is the Most Under-Built Subsystem (and the #1 Deal Killer)
Auth is the subsystem engineering teams underinvest in most consistently. It ships as 'email + password + JWT' in week 2, then collects technical debt for 18 months until an enterprise customer's security team asks for SSO, MFA, SCIM, and a signed audit log of every login attempt. At that point, the deal stalls in security review for 6–12 weeks while the engineering team scrambles to retrofit SAML, integrate an IdP, and explain why the JWT secret is hardcoded in the env file.
The pattern is so predictable we can forecast the deal's outcome from the auth architecture. SaaS apps with `is_admin: boolean` and email/password-only auth win ~15% of enterprise deals (those over 500 employees). SaaS apps with SAML SSO, MFA, SCIM, and a real RBAC model win ~55%. The 40-point gap is not closed by feature parity, price, or sales effort — it is closed by identity architecture, or it is not closed at all.
SSO added late, integrated wrong
SAML 2.0 is a 2005-era XML protocol with idiosyncrasies that catch every team the first time: signed assertions, encrypted assertions, audience restrictions, recipient checks, relay state, IdP-initiated vs. SP-initiated flows. Teams that 'just add a SAML library' ship something that passes the integration test with Okta but fails with Azure AD, or passes both but breaks on the customer's 4th login because of a session lifetime mismatch.
MFA bolted on as a feature flag, not an architecture
MFA added late is a 2-week project to add a TOTP enrollment flow and a verification gate. MFA designed as architecture is a 6-week project that also includes WebAuthn passkeys, recovery codes, MFA enforcement policies per-role and per-tenant, MFA challenge on sensitive actions, and admin tooling to reset a user's MFA when they lose their device. The first kind ships a security-theater MFA. The second kind ships an MFA that actually blocks account takeover.
RBAC is a column on the users table
`role: 'admin' | 'member'` on the users table is not RBAC — it is a string comparison. Real RBAC has roles with permissions, resources with ownership, and a `can(user, action, resource)` evaluator checked at every route boundary. Without it, the codebase accumulates `if (user.role === 'admin')` checks in 47 route handlers, every new feature needs a new role added to the enum, and the security review for an enterprise customer takes 3 weeks instead of 3 days.
No SCIM — manual user provisioning kills adoption
Without SCIM 2.0, every new hire at an enterprise customer requires a human to create their account in your SaaS. Every termination requires a human to deactivate them. IT teams refuse to adopt SaaS without SCIM because the manual overhead does not scale past 50 users. SCIM is the difference between a 200-seat deployment that sticks and one that churns after 90 days.
Auth is not a feature you add in week 2 — it is an architectural concern that determines your enterprise win rate, your compliance posture, and your customer support load. We design auth as a system: identity provider integration (SAML, OIDC, social), credential models (password, passwordless, passkeys, MFA), authorization models (RBAC with optional ABAC overrides), session management (JWT vs. session cookies vs. opaque tokens), provisioning (SCIM 2.0 in and out), and audit logging (every login, every permission check, every admin action). The deliverable is not a login form — it is an identity system that closes enterprise deals, passes compliance audits, and reduces support tickets by 60–80% versus a retrofit auth stack.
What an Enterprise Auth System Actually Looks Like
An enterprise auth system is a stack of cooperating standards, vendors and patterns. Understanding each layer — and the contract between them — is the difference between a system that passes a 2-week security review and one that fails it for 6 months.
01Federation: SAML 2.0, OIDC, and the SSO landscape
Single Sign-On (SSO) is the user-facing feature; federation is the protocol layer that delivers it. Two standards dominate enterprise: SAML 2.0 (2005, XML-based, used by Okta, Microsoft Entra ID, Google Workspace, OneLogin) and OpenID Connect (OIDC, 2014, JSON/JWT-based, used by consumer IdPs and a growing share of enterprise). SAML is the default for enterprise B2B SaaS — every Fortune 1000 IT team has a SAML IdP configured and a process for adding new SaaS apps to it. OIDC is the modern alternative, increasingly preferred by technical buyers but not yet universal in enterprise IT.
The non-obvious complexity in SAML is the metadata exchange. The IdP publishes its metadata (certificates, endpoints, entity ID) at a URL; your SaaS consumes it and publishes its own SP metadata back. Certificate rotations at the IdP (typically annual) silently break SAML integrations if your SP does not re-fetch metadata on a schedule. We configure automatic metadata refresh every 24 hours and alert on signature verification failures — the most common root cause of 'SSO just stopped working for customer X' tickets.
- SAML 2.0
- Security Assertion Markup Language. An XML-based SSO protocol where the IdP signs an assertion containing the user's identity and attributes, and the Service Provider (your SaaS) verifies the signature and grants a session. Used by virtually every enterprise IdP.
- OIDC
- OpenID Connect. A JSON/JWT-based identity layer on top of OAuth 2.0. The user is redirected to the IdP, authenticates, and is returned to your SaaS with an ID token (JWT) containing their identity claims. Simpler to implement than SAML and increasingly preferred.
- SP-initiated vs. IdP-initiated SSO
- SP-initiated: user navigates to your SaaS, clicks 'Sign in with SSO', enters their email, is redirected to their IdP, authenticates, and is returned. IdP-initiated: user opens their IdP dashboard (Okta, Entra ID), clicks your app icon, and is signed in directly. Enterprise IT teams expect both to work.
02MFA: TOTP, WebAuthn passkeys, and the post-password era
Multi-factor authentication is no longer optional for any app handling sensitive data. The three production-grade MFA factors are: TOTP (Time-based One-Time Password — Google Authenticator, 1Password, Authy), WebAuthn passkeys (FIDO2 — biometric or device-bound credentials stored in the OS keychain), and SMS (deprecated for any new build — vulnerable to SIM-swapping and not NIST-acceptable for strong identity verification).
WebAuthn passkeys are the post-password future. They are phishing-resistant (the credential is bound to the origin, so a fake login page cannot capture it), they require no second device (Face ID, Touch ID, Windows Hello), and they eliminate the 'forgot password' support flow entirely. We ship passkey-first auth on Stytch or Clerk for new consumer apps, with TOTP as a fallback for users on devices without biometrics. For enterprise B2B, we ship SSO + TOTP enforcement policies, with optional passkey enrollment for users who want to skip the SSO redirect on personal devices. Passkey adoption reduces account-takeover incidents by ~99% versus password-only auth, based on Google's published data on passkey rollouts.
03Authorization: RBAC, ABAC, and the can() evaluator
Authentication answers 'who are you?'; authorization answers 'what can you do?'. The clean pattern for SaaS authorization is RBAC with optional ABAC overrides. RBAC: roles (owner, admin, member, viewer) map to permissions (workspace.edit, user.invite, billing.manage); a user's role determines their permissions. ABAC: when RBAC is too coarse, attribute-based rules evaluate attributes of the user, resource and environment (e.g., 'user.department = finance AND resource.confidentiality = internal AND time-of-day is business hours').
The implementation pattern is a `can(user, action, resource)` evaluator invoked at every route boundary, every server action, and every mutation. The evaluator loads the user's role and the resource's ownership, checks the role-permission mapping, and returns a boolean. We implement this as a typed helper (`can(user, 'document.edit', document)`) with the permission matrix defined in code (not in the database — database-driven permissions are a security-review nightmare). For multi-tenant SaaS, the evaluator also enforces tenant scoping: a user in tenant A cannot act on a resource in tenant B, even if their role would otherwise permit it.
- RBAC
- Role-Based Access Control. Users are assigned roles; roles have permissions; permissions are checked at resource access. Simple, auditable, covers 90% of SaaS authorization needs.
- ABAC
- Attribute-Based Access Control. Access decisions evaluate attributes of the user (department, location), resource (owner, sensitivity), and environment (time, IP). More expressive than RBAC but harder to audit. Used for fine-grained overrides on top of RBAC.
- Principle of least privilege
- Users should have the minimum permissions required to do their job. Implemented by default-deny: every action is denied unless an explicit permission allows it. The opposite of 'admin can do everything, member can do everything else'.
04SCIM, sessions, and the identity lifecycle
SCIM 2.0 (System for Cross-domain Identity Management) is the REST API standard that lets enterprise IT teams provision and deprovision users automatically from their IdP. When a new hire starts at the customer's company, IT creates them in Okta, Okta calls your SaaS's SCIM endpoint, and the user account is created in your SaaS with the right role and group memberships — no manual step. When the employee leaves, IT deactivates them in Okta, and your SaaS automatically deactivates the account within minutes. SCIM is the difference between a 200-seat deployment that runs itself and one that requires a dedicated admin on the customer side.
Session management is the under-discussed layer. Three patterns: (1) JWT — stateless, signed, no DB lookup on every request, but cannot be revoked without a blocklist; (2) opaque session token + DB lookup — stateful, instantly revocable, but adds 2–5ms latency per request; (3) hybrid — short-lived JWT (15min) + refresh token (7d) with DB-backed revocation on refresh. We default to the hybrid pattern for SaaS: short-lived access tokens for API calls, refresh tokens for sessions, revocation on logout/password change/admin action. For high-security contexts (banking, healthcare), we use opaque session tokens with Redis-backed lookup — 0.3ms added latency, instant revocation.
Tech Stack: What We Build With
Our auth stack is opinionated and battle-tested across 47 production deployments, 11 of which have passed SOC2 Type II audits and 6 of which have passed HIPAA attestation. Every component below has shipped under real enterprise security review — not just a demo login flow.
Identity providers & vendors
- WorkOSEnterprise SSO (SAML + OIDC), SCIM directory sync, MFA, admin portal. Our default for B2B SaaS that needs enterprise SSO without the Auth0 price tag.
- ClerkConsumer-friendly auth with passkeys, social, organizations (workspaces), and B2B SSO. Best DX for Next.js apps. Used for SaaS with mixed consumer/enterprise user base.
- Auth0 / OktaEnterprise-grade IdP with the broadest protocol support and the largest enterprise customer base. Used when the customer already has an Okta investment or needs advanced features (adaptive MFA, anomaly detection).
- StytchPasswordless-first auth (passkeys, magic links, SMS). Used for consumer apps where passkey adoption is a UX differentiator.
- Keycloak (self-hosted) / Supabase AuthSelf-hosted or open-source option for clients with data residency constraints or cost sensitivity at scale. Keycloak for full enterprise feature parity; Supabase Auth for Postgres-integrated simplicity.
Standards & protocols
- SAML 2.0XML-based SSO protocol. The enterprise default. We implement via WorkOS/Clerk/Auth0 rather than hand-rolling — SAML has too many footguns for in-house implementation.
- OpenID Connect (OIDC)JSON/JWT-based identity layer on OAuth 2.0. The modern SSO standard. Used for consumer IdPs (Google, Apple) and a growing share of enterprise.
- OAuth 2.1The consolidated authorization standard (merges OAuth 2.0 + extensions). PKCE mandatory, implicit flow deprecated. Used for API authorization and 'Sign in with X' flows.
- SCIM 2.0REST API standard for user provisioning. /Users and /Groups endpoints, PATCH for partial updates. Required by enterprise IT teams for any deployment over 50 seats.
- WebAuthn / FIDO2Phishing-resistant credential standard for passkeys. Biometric (Face ID, Touch ID, Windows Hello) or device-bound (YubiKey). The post-password future.
Authorization, sessions & audit
- Casa / Oso / OPAPolicy-as-code authorization engines. OPA (Rego policies) for microservices; Oso (Polar language) for app-embedded RBAC; Casa for typed policy enforcement in TypeScript.
- JWT (jose / jose4j)Short-lived (15min) signed access tokens. RS256 asymmetric signing — the verification key is public, the signing key is private. jose library for JS, jose4j for Java.
- Redis session storeOpaque session tokens (random 256-bit strings) with Redis-backed lookup. 0.3ms latency, instant revocation. Used for high-security contexts (banking, healthcare).
- Audit log (Postgres append-only)Every auth event (login, logout, MFA challenge, SSO assertion, permission check, admin action) written to an append-only table. Retained 7 years for SOC2, longer for regulated industries.
- Sentry + Grafana + PagerDutyAnomaly detection on auth metrics (failed login spikes, SSO assertion failures, MFA challenge abandonment). Alerting on patterns that indicate attack or customer config drift.
Feature comparison
| Capability | DIY auth (email+password+JWT) | ClickTake Enterprise Auth |
|---|---|---|
| SAML 2.0 SSO | no | ✓WorkOS/Clerk/Auth0 |
| OIDC + social login | maybe | yes |
| SCIM 2.0 provisioning | no | ✓IdP-driven |
| WebAuthn passkeys | no | ✓Phishing-resistant |
| MFA (TOTP + WebAuthn) | no | ✓Configurable per-role |
| RBAC with can() evaluator | ✗s_admin boolean | ✓Typed permission matrix |
| Audit log on every event | no | ✓Append-only, 7y retention |
| Enterprise security review time | ✗–12 weeks | ✓1–2 weeks |
Methodology: From Discovery to Production in 5 Phases
We ship enterprise auth systems in 6–12 weeks using a fixed five-phase lifecycle. The phases are sequenced so that the highest-leverage architectural decisions (vendor, RBAC model, session strategy) are made before any login flow is built.
Discovery, Vendor Selection & RBAC Matrix
We map the user types (consumer, B2B admin, enterprise SSO user), the authentication methods (password, passwordless, SSO, MFA), the authorization model (RBAC roles and permissions, ABAC overrides if needed), and the compliance scope (SOC2, HIPAA, GDPR, ISO 27001). We recommend a vendor (WorkOS, Clerk, Auth0, Stytch, Keycloak, or Supabase Auth) based on your user mix, enterprise requirements, and budget. We draft the RBAC permission matrix in a spreadsheet, review it with your team, and commit it to the repo as a TypeScript enum.
Foundation: Vendor Integration, Sessions, RBAC Evaluator
We integrate the chosen vendor, build the login/signup/logout flows, wire up session management (JWT + refresh token, or opaque token + Redis), and implement the RBAC `can(user, action, resource)` evaluator with the permission matrix from phase 1. We add MFA enrollment via TOTP as the baseline factor. Every authentication and authorization event is written to the audit log. By end of week 4, a user can sign up, log in, enable MFA, and have their permissions enforced at every route boundary.
Enterprise SSO + SCIM + WebAuthn
We add SAML 2.0 SSO with automatic metadata refresh, OIDC social login (Google, Apple, Microsoft), SCIM 2.0 endpoints (/Users and /Groups) for IdP-driven provisioning, and WebAuthn passkey enrollment. We configure MFA enforcement policies: required for admins, required for sensitive actions (password change, billing change, data export), optional for read-only users. The SSO configuration UI is exposed in the admin tooling so customer IT teams can self-serve their IdP integration.
Hardening: Threat Model, Pentest, Compliance
We run a threat modeling session (STRIDE methodology) covering the auth surface: account takeover, credential stuffing, session fixation, privilege escalation, MFA bypass, SSO assertion forgery. We commission a third-party pentest from a partner firm and remediate every finding. We assemble the compliance evidence pack (architecture diagrams, RBAC matrix, audit log samples, encryption documentation) for SOC2/HIPAA/ISO 27001. We add rate limiting on auth endpoints (per-IP and per-account) and anomaly detection on failed login spikes.
Launch, Monitoring & Handoff
We cut over to production with a phased rollout (10% → 50% → 100% over 48 hours via feature flag). We configure auth dashboards in Grafana with alerting on failed login rate, SSO assertion failure rate, MFA abandonment rate, and session creation rate. We provide a 4-week hypercare period with on-call coverage from the build team, then hand off to your team or to a ClickTake managed SLA. Documentation: threat model, pentest report, compliance evidence, runbooks, and a recorded code walkthrough.
Industry Use Cases: Where Enterprise Auth Compounds Value
The use cases below are drawn from production deployments shipped between 2022 and 2026. Each card describes the specific business problem, the identity system we built, and the measurable result — not aspirational marketing copy.
B2B SaaS (Enterprise Sales)
- Problem
- A project management SaaS had 80% of enterprise deals stall in security review because they lacked SSO and SCIM. Win rate on deals over 500 seats was 12%.
- Application
- Implemented SAML SSO via WorkOS, SCIM 2.0 provisioning, MFA enforcement for admins, and a self-serve SSO configuration UI in the admin tooling. Customer IT teams could configure their IdP integration without engineering involvement.
- Result
- Enterprise win rate rose from 12% to 58% on deals over 500 seats. Security review time fell from 8 weeks to 9 days. ARR from enterprise tier grew 4.1x in 12 months.
Healthcare (HIPAA)
- Problem
- A telehealth platform needed HIPAA-compliant auth with audit logging of every PHI access. Existing email/password auth had no audit trail and failed the HIPAA attestation.
- Application
- Re-platformed on Auth0 with BAA, MFA mandatory for all clinicians, audit log on every login and every PHI access, session timeout at 15 minutes of inactivity (HIPAA requirement), and SSO for the enterprise tier. Passkey enrollment for clinicians on hospital-issued devices.
- Result
- HIPAA attestation passed in 11 weeks. Enterprise pipeline unlocked $4.2M in contracts. Zero PHI access incidents in 18 months post-launch.
Financial Services
- Problem
- A fintech app required strong customer authentication under PSD2 (EU) and had a 4.2% account-takeover fraud rate driven by credential stuffing from breached password databases.
- Application
- Passkey-first auth on Stytch (Face ID/Touch ID), with TOTP fallback and SMS as last resort. Adaptive MFA triggered on new device, new geography, or high-value transaction. Bot detection on login (Cloudflare Bot Management) blocked 96% of credential stuffing attempts.
- Result
- Account-takeover fraud rate fell from 4.2% to 0.06%. Customer support tickets about 'forgot password' fell 91% (passkeys eliminate the flow). NPS rose 12 points on the auth UX alone.
Consumer App (Passkey-First)
- Problem
- A consumer productivity app had a 38% cart abandonment on signup because of password creation friction (the password requirements, the email verification loop, the 'sign in with Apple' followed by re-entering password on subsequent logins).
- Application
- Passkey-first signup on Stytch — user enters email, gets a passkey enrollment prompt, signs in with biometrics on every subsequent visit. No password ever created. TOTP fallback for users on devices without biometrics. Magic link fallback for users who lose their device.
- Result
- Signup completion rose from 62% to 89% (44% relative lift). 30-day login retention rose 23%. Customer support tickets about auth fell 78%.
Internal Enterprise Tools
- Problem
- A 4,000-employee enterprise had 14 internal tools, each with its own login. IT was spending 12 FTEs on tool administration — provisioning, deprovisioning, password resets, MFA enrollment.
- Application
- Unified identity layer with Okta as the central IdP, SAML SSO to every internal tool, SCIM 2.0 provisioning from Okta to each tool, RBAC synced from Okta groups, and a single audit log aggregating auth events from all tools.
- Result
- Tool administration FTEs fell from 12 to 3. New tool onboarding time fell from 6 weeks to 4 days. SOX audit findings on access management dropped to zero.
Comparative Analysis: Auth Vendors & Patterns
An objective comparison of the auth vendors and patterns teams consider. We have integrated with all of them — the right choice depends on your user mix, enterprise requirements, and budget.
Auth vendors: WorkOS vs. Clerk vs. Auth0 vs. Stytch vs. Keycloak vs. Supabase
| Dimension | WorkOS | Clerk | Auth0/Okta | Stytch | Keycloak | Supabase |
|---|---|---|---|---|---|---|
| Best for | Enterprise B2B | Mixed B2C/B2B | Large enterprise | Passwordless consumer | Self-hosted enterprise | Postgres-integrated |
| SAML SSO | yes | ✓Organizations | yes | maybe | yes | no |
| SCIM 2.0 | yes | ✓Organizations | yes | no | yes | no |
| Passkeys (WebAuthn) | yes | yes | yes | ✓Best-in-class | yes | maybe |
| Pricing model | Per-user + SSO fee | Per-MAU | Per-MAU + SSO add-on | Per-MAU | Self-hosted (free) | Per-MAU |
| DX for Next.js | ✓Good | ✓Best-in-class | maybe:OK | ✓Good | ✗anual | ✓Good |
| Enterprise penetration | ✓Growing | ✗ewer | ✓Dominant | ✗ewer | ✓Open-source | ✗ewer |
Session management: JWT vs. opaque token vs. hybrid
| Dimension | JWT (stateless) | Opaque token + DB | Hybrid (JWT + refresh) |
|---|---|---|---|
| Latency per request | ✓<1ms | ✗–5ms | ✓<1ms (cached) |
| Instant revocation | ✗eeds blocklist | yes | ✓On refresh |
| Scalability | ✓Stateless | ✓With Redis | ✓Stateless |
| Implementation complexity | ✓Low | maybe:Medium | ✗edium-High |
| Best for | Read-heavy APIs | High-security (banking, healthcare) | SaaS (default) |
Business Impact: Deal Win Rate, Support Load & Risk
Enterprise auth systems earn their budget back through four mechanisms: enterprise deal win rate (SSO is a deal-breaker for >500-employee customers), support ticket reduction (passkeys eliminate the 'forgot password' flow), risk reduction (MFA + passkeys block ~99% of account takeover), and compliance enablement (audit logs + SSO unlock SOC2/HIPAA/ISO 27001 contracts). The numbers below are aggregated across 47 production auth deployments shipped 2022–2026.
Enterprise deal win rate is the most directly attributable impact. We have shipped SSO + SCIM + MFA to 18 B2B SaaS clients, and the win rate on deals over 500 seats moved from a pre-engagement median of 15% to a post-engagement median of 55%. The 40-point gap is not closed by features, price, or sales effort — it is closed by identity architecture. The math is simple: an enterprise customer's security team has a checklist, SSO and SCIM are on it, and a SaaS without them does not pass go. For a SaaS at $5M ARR with 40% of pipeline in enterprise deals, the win-rate lift translates to $3M–$5M of additional ARR per year.
Support ticket reduction is the operational impact. Password-based auth generates a predictable stream of 'forgot password', 'password reset email not arriving', 'cannot sign in after MFA device lost', and 'SSO not working' tickets — typically 18–28% of tier-1 support volume. Passkey-first auth eliminates the 'forgot password' flow entirely (78% reduction in auth-related tickets across our passkey rollouts). SSO with self-serve configuration UI eliminates the 'SSO not working' tickets (the customer IT team configures it themselves, and the audit log shows exactly what they configured). The reclaimed support capacity can be redirected to product issues that actually drive churn.
Risk reduction and compliance enablement are the impacts that show up on the year-two review. Account-takeover incidents drop by ~99% after passkey rollout (per Google's published data and our own client results). The avoided cost of a single account-takeover incident on a regulated workflow — fraud loss, customer notification, regulatory reporting, reputational damage — typically exceeds the entire build cost of the auth system. The compliance enablement is the contract unlock: HIPAA attestation, SOC2 Type II audit, and ISO 27001 certification all require audit logging, RBAC, and MFA — once the auth system is in place, these audits become a paperwork exercise instead of a 6-month engineering project.
Integrations & Ecosystem
Auth systems integrate with the rest of your stack — identity providers, HR systems, security tools, audit platforms, and the application itself. The lists below cover the integrations we ship most often; if your customers use a different vendor on any layer, we have likely integrated with it before.
Identity providers (IdP)
Auth vendors & platforms
Authorization & policy
Security, audit & monitoring
Security & Compliance
Case Studies: Two Production Deployments in Detail
Below are two anonymized but factual case studies from 2024–2025 deployments. Names are withheld under NDA; the numbers are real and verifiable on request.
B2B SaaS project management tool, ~$14M ARR, 4,200 customers, 80% enterprise pipeline
Case Study- Situation
- 80% of enterprise deals (over 500 seats) were stalling in security review. The product had email/password auth with an `is_admin` boolean and no SSO, no SCIM, no MFA. Win rate on enterprise deals was 12%. The sales team was losing deals to competitors whose product was objectively worse but whose auth stack passed security review in 2 weeks. Engineering estimated 6 months to build SSO in-house.
- Task
- Implement enterprise-grade auth (SSO, SCIM, MFA, RBAC, audit log) in under 12 weeks. Lift enterprise win rate from 12% to 50%+. Do not break existing customer logins during migration.
- Action
- ClickTake ran a 10-week engagement. We selected WorkOS as the vendor (best SSO/SCIM DX for the price, no per-seat SSO fee that would have killed the deal economics). We built the SAML SSO flow with automatic metadata refresh, SCIM 2.0 endpoints for provisioning, TOTP MFA enforcement for admins, a real RBAC model replacing the `is_admin` boolean (4 roles: owner, admin, member, viewer; 18 permissions; `can(user, action, resource)` evaluator at every route boundary), and an append-only audit log. We added a self-serve SSO configuration UI in the admin tooling so customer IT teams could configure their IdP integration without engineering involvement. Existing customers were migrated to the new auth with a one-time password-reset flow, and the migration was completed with 0.04% support ticket rate.
- Result
- Enterprise win rate rose from 12% to 58% within 90 days of launch (4.8x improvement). Security review time fell from a median of 8 weeks to a median of 9 days. ARR from the enterprise tier grew 4.1x in 12 months, from $2.1M to $8.6M. Auth-related support tickets fell 64% (the self-serve SSO config UI eliminated the 'SSO not working' ticket category). The sales team now uses 'passes enterprise security review in under 2 weeks' as a competitive differentiator.
We were losing deals to objectively worse products because their auth was enterprise-ready and ours wasn't. ClickTake's auth system paid for itself in the first enterprise deal that closed post-launch — and we've closed 14 more since.
Consumer fintech app, 280K users, ~$3.2M ARR, EU-regulated under PSD2
Case Study- Situation
- The app required strong customer authentication under PSD2 but had email/password + SMS MFA. Account-takeover fraud rate was 4.2% — driven primarily by credential stuffing from breached password databases. SMS MFA was being bypassed via SIM-swapping. Customer support was spending 31% of capacity on 'forgot password' and 'cannot sign in' tickets. NPS on the auth UX was the lowest-scoring aspect of the product.
- Task
- Reduce account-takeover fraud rate to under 0.5%. Eliminate the 'forgot password' support flow. Pass PSD2 SCA audit. Do not lose users in the migration to passkey-first auth.
- Action
- ClickTake ran a 9-week engagement. We selected Stytch as the vendor (best-in-class passkey DX, passwordless-first architecture). We rebuilt the signup flow as passkey-first: user enters email, gets a passkey enrollment prompt, signs in with Face ID/Touch ID/Windows Hello on every subsequent visit — no password ever created. We added TOTP fallback for users on devices without biometrics, magic link fallback for users who lose their device, and adaptive MFA triggered on new device, new geography, or high-value transaction. We added Cloudflare Bot Management to block credential stuffing at the edge (blocked 96% of attempts before they reached the auth layer). Existing users were migrated with a 90-day grace period during which they could log in with their old password and were prompted to enroll a passkey on each login. Migration completion: 78% in 90 days, 94% in 180 days.
- Result
- Account-takeover fraud rate fell from 4.2% to 0.06% within 60 days of full rollout (99% reduction). Customer support tickets about auth fell 78% (the 'forgot password' flow was eliminated entirely). NPS rose 12 points on the auth UX alone, with users citing 'never have to remember a password' as a top-3 reason for recommending the app. PSD2 SCA audit passed with zero findings. The team raised a Series B at a 2.4x higher valuation 6 months post-launch, citing the fraud reduction and NPS lift as key metrics.
We were skeptical that passkeys would work for non-technical users. They work better than passwords — our 65+ user segment has the highest passkey adoption. The fraud reduction alone paid for the engagement in 4 months.
Frequently Asked Questions
Grouped by category. If your question is not here, book a 30-minute call — we answer most identity architecture questions in the first 10 minutes.
Pricing & Timelines
Build cost ranges from $40K (vendor integration + RBAC + audit log, no SSO/SCIM) to $180K (SAML SSO + SCIM + MFA + passkeys + RBAC + audit log + pentest + compliance evidence pack + 6-month managed SLA). The dominant cost drivers are: vendor (WorkOS/Clerk are cheaper than Auth0; self-hosted Keycloak is free but adds ops cost), enterprise SSO/SCIM (adds 2–3 weeks), passkeys (adds 2 weeks), compliance scope (HIPAA adds 2–3 weeks, SOC2 alignment adds 1–2 weeks), and pentest (adds 1–2 weeks + $8K–$15K third-party fee).
Technical Specs
Both, for enterprise B2B SaaS. SAML is the default in enterprise IT — Okta, Entra ID, Google Workspace, OneLogin all speak SAML, and most enterprise security teams have a SAML-first integration process. OIDC is increasingly preferred by technical buyers but is not yet universal in enterprise IT. For consumer SaaS, OIDC (and OAuth 2.1 for social login) is sufficient. We use WorkOS or Clerk Organizations which abstract both protocols behind a unified API — your SaaS code does not care which protocol the customer's IdP speaks.
Security & Compliance
Four layers: (1) Cloudflare Bot Management at the edge — blocks 96% of credential stuffing attempts before they reach the auth layer, using TLS fingerprinting and IP reputation; (2) per-IP rate limiting (10 login attempts per minute, exponential backoff after 5 failures); (3) per-account lockout (account locked for 15 minutes after 10 failed attempts, unlock via email); (4) have-I-been-pwned integration — when a user sets a password, the password hash's prefix is checked against the HIBP API, and passwords in known breaches are rejected. This pattern has held account-takeover rates under 0.1% across all deployments.
Working with ClickTake
Engineering hubs in Birmingham (UK) and Multan (Pakistan), with business-development desks in Austin (USA) and Dubai (UAE). Most engagements are staffed across the UK and Pakistan hubs, giving you UK business-hours coverage plus an extended Pakistan delivery window for faster turnaround. We use Linear for issue tracking, GitHub for code, Slack Connect for daily communication, and 1Password for shared credential management (critical for auth work).
Ready to Build Enterprise-Grade Auth?
Book a free 30-minute identity architecture call. We will review your current auth setup, sketch the target architecture on a whiteboard with you, and tell you honestly whether SSO/SCIM is the right next step — or whether passkey-first consumer auth, RBAC cleanup, or audit log implementation would deliver more value first.
Related Resources
Dive deeper. Hand-picked guides, case studies, and adjacent services that pair naturally with this page.