Appwrite combines Auth, TablesDB, Storage, Functions, Realtime, and Messaging behind consistent APIs; Cloud and self-hosted products resemble each other but have different operational ownership.
Better Auth unifies login, sessions, providers, and plugins; applications still own resource authorization, revocation latency, and policy for agent actions.
Better Auth trades a managed identity platform for an in-app library and your own database; that gives you control, but migrations, security updates, and incident response become your responsibility.
Clerk's real value is an integrated identity lifecycle, not a sign-in box; resource authorization, tenant isolation, and business-data consistency remain your application's responsibility.
Firebase moves quickly because client SDKs directly access managed Auth, Firestore, and Storage; the real backend contract lives in data models, Security Rules, Functions, and cost limits.
Stytch is an API-first managed identity platform: choose the Consumer or B2B model, converge authentication factors into sessions, then enforce organization and RBAC boundaries on the server.
SecretRefs keep credentials out of plaintext config, and the model-call chain sees process-local sentinels instead of the real value. But the docs say it plainly: this is not process isolation — the real value still exists in the same process's memory, and any plaintext file the agent can read bypasses the whole mechanism.
The Gateway binds to loopback by default, and binding anywhere else requires auth — that is enforced, not advised. Inside a detected container the effective default is auto, unless Tailscale serve/funnel is active, which always forces loopback.