How to get picked for authentication by coding agents
WorkOS AuthKit took 26% of 201 judged authentication sessions. What the numbers say a vendor in this category should do.
If you sell authentication providers, this page is the part of the market no dashboard shows you: what a coding agent does when a developer asks for authentication and never compares vendors.
The numbers come from 201 judged sessions with Claude Code, Codex and Cursor, spread across 17 realistic codebases, with every session read by a judge.
What coding agents choose for authentication
Across 201 judged sessions, WorkOS AuthKit was chosen most often, in 26% of runs. Auth0 was second with 23%.
| # | Product | Runs won | Share |
|---|---|---|---|
| 1 | WorkOS AuthKit | 53 | 26% |
| 2 | Auth0 | 46 | 23% |
| 3 | Microsoft Entra ID | 21 | 10% |
| 4 | Built in-house (no product adopted) | 21 | 10% |
| 5 | Clerk | 20 | 10% |
| 6 | Better Auth | 8 | 4% |
| 7 | Keycloak | 7 | 3% |
| 8 | Google Identity | 3 | 1% |
| 9 | Remix Auth | 3 | 1% |
| 10 | Ory Kratos | 3 | 1% |
Full board, every run replayable: the authentication leaderboard.
What the shape of this category means
The leader takes only 26% of runs. This category is genuinely open and the ordering can be moved.
With the top product at 26%, authentication is decided in the moment, from what the agent reads and what it finds in the repository. Nothing is locked in, which is the best situation a vendor can be in and the one where the work pays fastest.
The order here is set by the quality of what an agent can read and by whether your product is already present in the codebase. Both are things you can change.
The agents do not agree with each other
In this category the three agents we ran put different products first.
| Agent | Runs | Picked most often |
|---|---|---|
| Claude Code | 65 | WorkOS AuthKit (25) |
| Codex | 68 | Auth0 (20) |
| Cursor | 68 | Auth0 (15) |
That split decides where a vendor spends. Codex ran a web search in 53% of decision runs and Claude Code in 1.6%, so the pages you publish are live in half of Codex's authentication sessions and almost none of Claude Code's. Taking Auth0's position with Codex is a content problem. Taking WorkOS AuthKit's with Claude Code is a repository problem.
Who is asking changes the answer
Every request in this experiment was written as a specific kind of person. In this category the leader changes with the person.
| Who is asking | Runs | Picked most often |
|---|---|---|
| Vibe coder | 26 | Google Identity |
| Junior developer | 62 | WorkOS AuthKit |
| Senior engineer | 69 | Auth0 |
| Enterprise team | 44 | Microsoft Entra ID |
That is 4 different products winning authentication for 4 kinds of buyer, out of the same 201 sessions. Nobody here is winning authentication. They are each winning one kind of buyer.
If you sell to more than one of them, you need pages for each. See how to win the enterprise persona.
What you are really competing against
In 10% of runs the agent wrote the code itself rather than adopting a product. That is low enough that your competition is other vendors, but high enough to be worth watching.
Considered, and never chosen
Because the judge records every product an agent raised and not only the one it picked, this board also shows who kept reaching the shortlist and losing. In authentication the clearest case is Supabase Auth: on the table in 69 sessions, chosen in none.
| Product | Raised in | Chosen in |
|---|---|---|
| Supabase Auth | 69 sessions | 0 |
| Auth.js | 55 sessions | 0 |
| Stytch | 39 sessions | 0 |
| Passport | 33 sessions | 0 |
| Lucia | 30 sessions | 0 |
Being rejected is a better position than being unknown, and a cheaper one to fix. The product is already in the agent's head and on the list. Whatever ended those 226 sessions is recorded in each transcript, one reason at a time.
What to do about it in authentication
- Aim at second place first. WorkOS AuthKit holds 26% and Auth0 holds 23%. The gap between the default and the field is where the reachable sessions are.
- Pick which buyer you are for. The same authentication need written as a vibe coder landed on Google Identity, and written as an enterprise team landed on Microsoft Entra ID. Those are two markets, and the enterprise one needs pages containing the constraint words: audit log, data residency, retention, single sign-on. See how to win the enterprise persona.
- Measure per agent. Claude Code put WorkOS AuthKit first, Codex put Auth0 first, Cursor put Auth0 first. A blended number for authentication describes a market that does not exist.
The work that applies to every category rather than to this one is written up separately: audit your documentation, write a quickstart an agent can follow, and how to measure install share.
Every authentication provider on this board
One page per product, with its install share, the per-agent split, and how often it was raised without being chosen.
- Do coding agents recommend WorkOS AuthKit? — chosen in 26% of sessions
- Do coding agents recommend Auth0? — chosen in 23% of sessions
- Do coding agents recommend Microsoft Entra ID? — chosen in 10% of sessions
- Do coding agents recommend Clerk? — chosen in 10% of sessions
- Do coding agents recommend Better Auth? — chosen in 4% of sessions
- Do coding agents recommend JWT? — raised in 122 sessions, chosen in none
- Do coding agents recommend Supabase Auth? — raised in 69 sessions, chosen in none
Where these numbers come from
201 judged sessions in authentication across 17 codebases, part of a published set of 5,292. Real coding agents at pinned versions, in sandboxes, inside realistic codebases, with a simulated project owner in the loop and a blind judge on every session. The full method is on one page: how we measured this.
Every authentication run can be replayed on the board.
<!-- generated by scripts/write-data-pages.mjs -->
Common questions
How many codebases is this based on?
201 judged sessions across 17 realistic codebases. A category only runs on repositories where its seam is open, so coverage differs: some categories ran on more than ten codebases and some on two.
What authentication provider do coding agents choose?
Across 201 judged sessions, WorkOS AuthKit was chosen most often, in 26% of runs. Auth0 was second with 23%. The result changes by agent and by who is asking.
Do Claude Code and Codex pick the same authentication provider?
No. Claude Code picked WorkOS AuthKit, Codex picked Auth0, Cursor picked Auth0. Measuring one agent tells you about part of the market only.
How often do agents build authentication themselves instead of installing something?
In 10% of runs the agent wrote the code itself rather than adopting a product.
How can a vendor improve its position here?
Make the quickstart run when pasted, state the current version on the documentation page, use one name across product, package and import, write pages for the symptoms users describe rather than only the category name, and get into the repository through templates and framework integrations.
Which authentication providers do agents consider but never choose?
Supabase Auth (raised in 69 sessions, chosen in none), Auth.js (raised in 55 sessions, chosen in none), Stytch (raised in 39 sessions, chosen in none), Passport (raised in 33 sessions, chosen in none), Lucia (raised in 30 sessions, chosen in none). Being considered and not chosen is a different problem from being unknown, and it is usually fixable.
Where this comes from
Armature ran 5,292 judged sessions with Claude Code, Codex and Cursor inside 51 realistic codebases, and published every run. The numbers on this page come from that work.