The biggest problem with any of these &quot;login as a service&quot; systems is that on the web, you need to be able to set a secure (HTTPS only), server-only cookie in order to provide a persistent login. You can implement that on your own server on top of this using their API, but it makes the amount of work much closer to &quot;rolling your own&quot; than &quot;paste one line of JS on your static html site hosted in s3.&quot;<p>The alternative is to either force a login on every visit, or store a session token in localstorage or similar, where any XSS vulnerability opens your sessions to an easy exploit. Auth0 and Stormpath, which are the 2 of these I have looked at most closely, seem to do the 2nd of those. Not sure what these guys recommend yet but I imagine it is similar.<p>On mobile, this does not matter as much due to better filesystem access that an app will usually be granted compared to JS in a browser tab, where you can save your API key&#x2F;JSON web token&#x2F;etc.<p>Auth is hard, but the cost-to-benefit of outsourcing seems fundamentally limited at this time due to the storage problem on the web.