# Sign-in and identity

> How users sign in, reset passwords and use Google, Microsoft or their company login. Nicolas Dao's picks for this job (Cloudless Labs, Sydney), in order of preference, what he would avoid, and what to use instead.

- Use case 20 of 21 in The Stack, last reviewed 21 October 2026
- Web page: https://cloudlesslabs.com/stack/use-cases/sign-in/

Picks, in order of preference:

1. **[Better Auth](https://cloudlesslabs.com/stack/better-auth/index.md)** (My default): First pick for a serious app on Postgres: users in your own database, one store, more features than Cognito, no per-user fee. You build the screens and wire the emails.
2. **[Amazon Cognito](https://cloudlesslabs.com/stack/aws-cognito/index.md)** (My default): The easy pick for small internal apps and admin panels: hosted login, reset emails and social sign-in out of the box, free under 10,000 users.
3. **[Resend](https://cloudlesslabs.com/stack/resend/index.md)** (My default): Sends Better Auth's reset, verification and magic-link emails.
4. **[Cloudflare Workers](https://cloudlesslabs.com/stack/cloudflare-workers/index.md)** (My default): Verifies the tokens at the edge, from either one.

Worked example: [Better Auth or Cognito?](https://cloudlesslabs.com/stack/guides/sign-in/index.md)

## The picks in brief

- [Better Auth](https://cloudlesslabs.com/stack/better-auth/index.md): My default. My first pick for serious apps on Postgres. Your users live in your own database, it does more than Cognito, and it costs nothing per user. Pricing: Free (MIT), with no per-user fee. You pay only for the Lambda and the Postgres you already run. Optional hosted extras (Better Auth Infrastructure): Pro $20 a month with one self-serve SSO connection, then $50 a month per extra connection.
- [Amazon Cognito](https://cloudlesslabs.com/stack/aws-cognito/index.md): My default. The easiest pick for small apps, internal tools and admin panels. Everything works out of the box and it's free below 10,000 monthly users. For serious apps on Postgres, Better Auth comes first. Pricing: Lite and Essentials: 10,000 monthly active users free per account, then $0.015 per user on Essentials (Lite from $0.0055, without passkeys or email codes). Enterprise SSO users: 50 free, then $0.015 each.
- [Resend](https://cloudlesslabs.com/stack/resend/index.md): My default. My email service. Transactional and marketing on one platform, built for developers and agents. Pricing: Transactional: $20 a month for 10k emails, $35 for 100k, $650 for 1M. Marketing: $40 a month for 5k contacts, $180 for 25k, $450 for 100k.
- [Cloudflare Workers](https://cloudlesslabs.com/stack/cloudflare-workers/index.md): My default. The edge primitive. It sits between your users and your real backend, and it's very, very good at that. Pricing: $5 a month per account, including 10M requests and 30M CPU-ms. Then $0.30 per million requests and $0.02 per million CPU-ms. Billed on CPU time only: waiting is free. No egress charges.

## Related

- [Better Auth or Cognito?](https://cloudlesslabs.com/stack/guides/sign-in/index.md): the worked example for this job, with costs
- [Edge](https://cloudlesslabs.com/stack/layers/edge/index.md): every tool in this layer
- [Email](https://cloudlesslabs.com/stack/layers/email/index.md): every tool in this layer
- [Accounts, identity and cost](https://cloudlesslabs.com/stack/layers/accounts/index.md): every tool in this layer
- [Every use case and tool in one file](https://cloudlesslabs.com/stack/brief.md)
- [Map of every Markdown file on cloudlesslabs.com, with what each one answers](https://ask.cloudlesslabs.com)