Authentication Strategy Prompt
Choose how users prove who they are — sessions vs tokens, passwords vs passwordless, SSO and MFA — decided on your real constraints, not the default tutorial.
Overview
Authentication is hard to change once users exist, so the choice deserves more than copying a tutorial. This prompt works the decision on trade-offs: session vs token, where credentials live, whether to support SSO and MFA, how it behaves across web/mobile/API clients, and the recovery and revocation paths — ending in a chosen strategy with its reasoning, not a default.
Why This Works
- Auth is expensive to change later, so the upfront trade-off matters
- Designing revocation and recovery early avoids the classic auth gaps
- Multi-client thinking prevents the mobile path that weakens the web path
Best for
- Greenfield products choosing their auth foundation
- Teams tempted to copy an auth tutorial wholesale
- Products spanning web, mobile, and API clients
Not for
- Reviewing JWT implementation specifics — use the JWT Security Review Prompt
- Designing roles and permissions — use the RBAC Design Prompt
Use cases
- Choosing an auth approach for a new product
- Deciding between sessions and tokens on real trade-offs
- Designing recovery and revocation up front