# Choose how users sign in

A step of the [Cloud application](https://gradus.kazet.blog/tree/cloud-application) tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Page: https://gradus.kazet.blog/tree/cloud-application/step/choose-sign-in

Decide who holds your users' credentials: this service or a hosted identity provider, weighed against this product and written as a decision record. Nothing installed yet.

Usually comes after: [Users & identities](https://gradus.kazet.blog/tree/cloud-application/step/users-and-identities).

Leads to: [Passwords & sessions](https://gradus.kazet.blog/tree/cloud-application/step/passwords-and-sessions), [Connect an identity provider](https://gradus.kazet.blog/tree/cloud-application/step/connect-identity-provider), [Sign-in flow](https://gradus.kazet.blog/tree/cloud-application/step/sign-in-flow).

## Prompt for your AI assistant

```
Read docs/index.md and everything under docs/product and docs/decisions. Help me decide how users sign in: passwords and sessions in this service through a maintained library, or a hosted identity provider such as Auth0, Clerk, WorkOS, Firebase Authentication or Amazon Cognito. For each option say what it costs at my likely first-year user count, who handles reset, verification and MFA, how the sign-in page gets built and how hard it is to leave. Treat a hosted provider as the default for a product strangers trust with an account and recommend own passwords only for a concrete reason of this product's. Stop for my pick, then write the next docs/decisions record with context, options, decision and consequences. Install nothing yet.
```

Every step of the tree: https://gradus.kazet.blog/tree/cloud-application/llms.txt