FusionAuth Blog

Why does the https://fusionauth.io/ website suck then? Enough of these code is worthless propaganda articles.

As someone who came from Auth0 and god-awful Amazon Cognito, we've been using FusionAuth for years. Their APIs and SDKs have been amazing to work with. They even have a lambda feature to add additional logic around certain workflows or adding claims to your JWTs. https://fusionauth.io It does what Auth0 does but significantly more cheaper and you can also self-host if you want. I built the Pulimi plugin for it which helps us easily configure it. If you don't use Terraform or Pulumi, they have this really cool kickstart feature where you can define a config file that will call their APIs on first time startup to set up the server. Really useful for local dev.

Come on over to the FusionAuth! The water is great! - https://fusionauth.io

FusionAuth (https://fusionauth.io/) | Senior Java Software Engineer, Sales Engineer | Denver, CO, USA ONSITE Our mission is to make authentication and authorization simple and secure for every developer. This means building the best IAM (Identity and Access Management) and CIAM (Customer Identity and Access Management) solution in the world. If you are passionate about technology and want to join a company that is moving the industry forward, FusionAuth might be a perfect fit for you. Technologies that we use: Java, Ruby, MySQL/PostgreSQL, Docker Learn more and apply here: https://fusionauth.io/jobs/

FusionAuth is great for those who want a solid self-hosted auth solution. It's open source & has many of the same features as much more expensive Auth-as-a-service providers. -> https://fusionauth.io/

Have you heard of https://fusionauth.io/ ? I'm not a user of the product, but I know some of the folks behind it. Might be time for them to shine here.

What do you think of an open core security product like https://fusionauth.io/ that supports those protocols ?

Thanks, that does look really good. I'll look into it. I've also been looking at https://fusionauth.io/. It's not easy to weigh up all the options. A simple script to generate JWT tokens might even be an option.

https://identityserver.io/ https://fusionauth.io/ https://www.keycloak.org/ https://www.gluu.org/ Basically all of them can run in a container, it's just hosting a few endpoints and generating tokens. The complexity is in the protocols and not the app. Some of them offer a user database as well and might require a SQL DB connection.

Keycloak seems to be a pretty good on-premise option. Hard to know what will come of it now that IBM bought RedHat. If on-premise is a requirement, you may want to look at FusionAuth. On premise, runs on Mac, Linux, Windows, Docker, and Kubernetes. This should check all of your boxes, installs in a few moments with the fast path install or docker-compose up. https://fusionauth.io/

I do think it's pretty amazing that a basic modern authorization system essential has a hard dependency on a 20+ million lines of code web browser, even for native apps. And mostly just because we need a central location to store auth cookies. I'd love to see a stripped-down "auth browser" that has no job other than rendering basic style-free forms (maybe even declared in JSON) and storing cookies. Problem is you have to get the big boys to stop requiring JavaScript for their auth flows. That said, after doing a decent amount of implementing OAuth2/OpenID Connect, the core profiles are actually pretty reasonable and about what you would want to do if you were starting from scratch. The trick is making sense of all the optional stuff. There have been some efforts[0] to improve that. The part I've never been able to figure out is why does OAuth2 use tokens at all, rather than generating a key pair and sending the public key with the initial auth request, then signing subsequent requests? [0]: https://fusionauth.io/articles/oauth/differences-between-oauth-2-oauth…

https://fusionauth.io/ also looks good

https://fusionauth.io/ is also a more modern alternative.

Nice website! I like your docs too. Small tip though, the couple obviously AI-written articles (ostensibly for SEO purposes) in your footer are a little of a code smell. Also design wise, the main logo item (vortex looking thingy) is a tad bit complex, maybe think about a redesign focused on making it more simple/recognizable. The rotating dashes on the landing page hero are a good motif though, so I'd lean into that. Also noticed that on this page: https://fusionauth.io/tech-papers/winter-2026-g2-fusionauth-momentum-l… the form under "To get this tech paper complete the form below." doesn't load on Firefox with Enhanced Tracking Protection enabled. Disabling it causes the form to load though.

Frankly, your pricing also sucks. What you are telling me now is that to go from "testing" to "production", it is $37->$500. I then click "Select" on $500 and it takes me to another page that is even more confusing. It lists a whole bunch more prices, no $500 price anymore and I have to go through the whole comparison again. https://fusionauth.io/pricing?step=hosting -> https://fusionauth.io/pricing?step=plan&hosting=ha-cloud None of this makes any sense. I'd go back to the drawing board. It is pretty astounding that this feedback hasn't been conveyed or managed before. Clearly a lot of effort has gone into what is presented and it really sets the tone for what working with your business would be like.

https://fusionauth.io/blog/why-passkeys-matter https://coderoasis.com/passkeys-will-replace-passwords/ https://developer.apple.com/videos/play/wwdc2022/10092/ https://arstechnica.com/information-technology/2023/05/passkeys-may-no… TLDR Replaces secret strings with crypto primitives mostly automatically managed.

> I’m not aware of anyone running Caddy at any sort of scale for customers. Well, to name a few... - Stripe (https://twitter.com/caddyserver/status/1559591673511813120) - Mercedes-Benz (https://github.com/caddyserver/caddy/pull/5275#issuecomment-1367478850… - Approximated.app (https://dev.to/carterbryden/how-to-allow-end-user-custom-domains-in-yo… - FusionAuth (https://fusionauth.io/blog/unlimited-domains-fusionauth) The problem is those using Caddy are shy, not that it's not used at all. I know this because I see users removing the `server` header on the Caddy forum all the time, and many of the large users are just shy of their technology stack when it comes to Caddy. Disclaimer: Member of the Caddy team

FusionAuth: It’s a form but not onerous to get to some prices. The base plans can be quite a bit cheaper though. https://fusionauth.io/pricing

We did quite a bit of research into this. If you need mostly B2C features I would have a look at Clerk [0] and Supertokens [1] If you are more interested in B2B features we found Ory [2], FusionAuth [3], and good old Keycloak [4]. None of them are fully comparable yet however, which might be the reason why they might get away with their current behaviour. [0] https://clerk.dev/ [1] https://supertokens.com/ [2] https://www.ory.sh/ [3] https://fusionauth.io/ [4] https://www.keycloak.org/

I always say this to CISO-types: FusionAuth SimplePass is the real magic, not magic links; https://fusionauth.io/blog/2021/04/01/fusionauth-introduces-simplepass elegant and yet zero attack vec

> don't use the implicit grant, please. Use the authorization code grant with PKCE. Here's an example (from a doc I helped write, talking about how bad the implicit grant is: https://fusionauth.io/learn/expert-advice/oauth/modern-guide... This is a bit of a strange security model. The implicit grant vulnerability mentioned is essentially a supply chain attack where an untrusted library is loaded. True, it can compromise the implicit grant token, but, in a mode where the implicit grant token is hidden, it's still talking as the website, and can do ~most~ anything, more or less that the token can do by making a request with the cookie, or whatever.

Second time I have seen FusionAuth mentioned, so I figured I'd take a look. Can you provide a link to the source? I can't seem to find it on their GitHub. They only appear to provide install scripts that grab the compiled java application off Google Storage. Also, you can self-host, but you must agree to a somewhat restrictive license[1] upon install. As I read it, you can only self-host on equipment you own or operate (I don't own or operate EC2), can't deploy for anyone else (no use in consulting), are agreeing to random audits with 30-day notice, and can only use for "Licensee's internal business purposes" (so only auth for internal applications, not public-facing?). Even if these things aren't true, I don't feel comfortable that I understand what I can actually use this for with their current license. [1]: https://fusionauth.io/license

Here's the discussion summary and video link. https://fusionauth.io/blog/2019/12/19/open-office-hours-19-12-17

This is exactly what I was looking for! They feature an "Ask AI" widget in the bottom-right of their own docs site (https://docs.kapa.ai/) and some of their customers are doing the same: https://www.prisma.io/docs | https://docs.mapbox.com/ | https://circleci.com/docs/ | https://fusionauth.io/docs/