The minimum auth setup for an MVP (and what to delete)

The MVP I most regret was the one where I spent two weeks on auth. Email/password, OAuth with Google and GitHub, password reset, email verification, account settings page. The MVP got 14 users in its first month. Six logged in twice. None used a third-party provider.

Here is the minimum auth I now ship in every MVP, and the cuts I make.

The minimum: magic-link only

One field: email. One button: "Send me a link." Click the link, you're in. Session lasts 30 days. That's the entire flow.

This solves:

• Account creation (it's just the first link click)
• Login (subsequent link clicks)
• Password reset (no password to reset)
• Email verification (you literally cannot sign up without proving you control the inbox)

Supabase, Clerk, Auth.js — all three support this out of the box. Pick the one your stack already uses.

What to skip in v1

• Password authentication: optional, adds two flows (set, reset). Skip until users complain.
• OAuth providers: nice-to-have, not needed. Adds dependency on Google's review process for production.
• Account settings page: there is nothing to set. Email is the account.
• Profile pictures: avatars from gravatar or just initials on a colored background. No upload UI.
• Multi-factor authentication: not until you have data worth protecting.
• Session devices list: you do not need this for v1. You barely need it for v5.
• Account deletion UI: a "delete me" email to your inbox is sufficient until you have GDPR-level traffic.

What to NOT skip

These are the things teams cut and then regret:

1. Rate limiting on the magic link endpoint. 5 requests per email per hour. Without this you become a spam vector.
2. HTTPS-only cookies for sessions. Never JavaScript-accessible. Set Secure, HttpOnly, SameSite=Lax.
3. One server-side check on every protected route. Trust nothing on the client.
4. A way for you, the founder, to log in as a user for debugging. Critical for support, easy to add later if you don't put it in v1.

When to add real auth

• Password auth: when 10+ users have asked for it.
• OAuth: when your sign-up conversion is the bottleneck (rare for SaaS, more common for consumer apps).
• MFA: when you store anything that could embarrass a user.
• Account settings: when there is more than one thing to set.

Every auth feature you ship is a flow you maintain forever. The cheapest auth is the auth you didn't build.

Default to less. Add when users demand it. Your engineering time at MVP stage is worth more than your future TODO list realizes.