Score

Identity Stack Maturity Assessment

Password-only: Users must create and use a password

Hybrid: Passwordless exists, but passwords are still the default path

Passwordless-first or only: Users primarily log in without passwords

We don’t support passwordless yet. Password-based auth only

Single passwordless method (e.g. only email magic links or only OTP or only social login)

Multiple passwordless methods (e.g. social + magic link, or social + OTP, etc.)

Separate flows: “Sign up” and “Log in” are separate entry points; users choose manually

Combined but naive: Combined form, but errors like “account already exists” are common and not guided

Merged smart flow: User enters email once; system routes to signup vs login intelligently

No, users effectively need separate accounts or log out/log in to switch

Technically yes, but clunky. Switching is possible but not quite intuitive

Yes, with a clean org switcher. Users can see all orgs and switch instantly from within the product

Available but limited — Only for certain plans or with engineering/sales involvement to set up

Well-supported — SSO is clearly documented, self-serve for customers, and used in production

Manual provisioning only — Admins or support manually create and remove users

JIT-only — Accounts are auto-created on first SSO login, but deprovisioning still manual

SCIM — Users are created/updated/removed automatically from the IdP (SCIM or equivalent)

2FA available only on paid/enterprise plans

2FA available across plans (including free)

Single recovery path — Either backup codes or admin reset, but not both

Multiple standard paths — Backup codes + admin reset and/or recovery email

Experimental or opt-in — Passkeys are available but hidden/advanced, typically for security-conscious users only

First-class second factor — Passkeys are promoted as a recommended or default strong factor for suitable users/orgs

No org created by default — User just gets a personal account; teams are an afterthought

Auto-created generic org — A workspace is created with a default name (e.g. “John’s Workspace”)

Guided org setup — User is prompted to name/setup the org with clear team-centric framing

Very basic or manual — Admins must share raw links or rely on ad-hoc processes

Email-based invites only — Unique invite links emailed per user

Flexible invite flows — Email invites + shareable links and/or API-based invites for programmatic onboarding