How to get picked for authentication by coding agents
Auth0 took 25% of 724 judged authentication sessions. What the numbers say a vendor in this category should do.
If you sell authentication providers, this page is the part of the market no dashboard shows you: what a coding agent does when a developer asks for authentication and never compares vendors.
The numbers come from 724 judged sessions with Claude Code, Codex, Cursor, Grok Build CLI and Muse Code, spread across 17 realistic codebases, with every session read by a judge.
What coding agents choose for authentication
Across 724 judged sessions, Auth0 was chosen most often, in 25% of runs. WorkOS AuthKit was second with 18%.
| # | Product | Runs won | Share |
|---|---|---|---|
| 1 | Auth0 | 180 | 25% |
| 2 | WorkOS AuthKit | 131 | 18% |
| 3 | Clerk | 86 | 12% |
| 4 | Microsoft Entra ID | 80 | 11% |
| 5 | Built in-house (no product adopted) | 65 | 9% |
| 6 | Better Auth | 29 | 4% |
| 7 | Amazon Cognito | 23 | 3% |
| 8 | Keycloak | 22 | 3% |
| 9 | Google Identity | 14 | 2% |
| 10 | Arctic | 11 | 2% |
Full board, every run replayable: the authentication leaderboard.
What the shape of this category means
The leader takes only 25% of runs. This category is genuinely open and the ordering can be moved.
With the top product at 25%, authentication is decided in the moment, from what the agent reads and what it finds in the repository. Nothing is locked in, which is the best situation a vendor can be in and the one where the work pays fastest.
The order here is set by the quality of what an agent can read and by whether your product is already present in the codebase. Both are things you can change.
The agents do not agree with each other
In this category Claude Code, Codex and Cursor did not put the same product first.
Grok Build CLI (50 sessions) and Muse Code (204 sessions) join this table with fewer runs, so read their rows as indicative.
| Agent | Runs | Picked most often |
|---|---|---|
| Claude Code | 133 | WorkOS AuthKit (40) |
| Codex | 204 | Auth0 (63) |
| Cursor | 133 | WorkOS AuthKit (27) |
| Grok Build CLI | 50 | WorkOS AuthKit (16) |
| Muse Code | 204 | Auth0 (59) |
That split decides where a vendor spends. In this category Codex ran a web search in 100% of its sessions and Claude Code in 25%, so what you publish reaches nearly all of Codex's authentication sessions and about a quarter of Claude Code's. Taking Auth0's position with Codex is mostly a content problem. Taking WorkOS AuthKit's with Claude Code leans more on the repository.
Who is asking changes the answer
Every request in this experiment was written as a specific kind of person. In this category the leader changes with the person.
| Who is asking | Runs | Picked most often |
|---|---|---|
| Vibe coder | 98 | Google Identity |
| Junior developer | 223 | Auth0 |
| Senior engineer | 243 | Auth0 |
| Enterprise team | 160 | Microsoft Entra ID |
That is 3 different products winning authentication for 4 kinds of buyer, out of the same 724 sessions. Nobody here is winning authentication. They are each winning one kind of buyer.
If you sell to more than one of them, you need pages for each. See how to win the enterprise persona.
What you are really competing against
In 9% of runs the agent wrote the code itself rather than adopting a product. That is low enough that your competition is other vendors, but high enough to be worth watching.
Considered, and never chosen
Because the judge records every product an agent raised and not only the one it picked, this board also shows who kept reaching the shortlist and losing. In authentication the clearest case is Auth.js: on the table in 163 sessions, chosen in none.
| Product | Raised in | Chosen in |
|---|---|---|
| Auth.js | 163 sessions | 0 |
| Passport | 77 sessions | 0 |
| Stytch | 76 sessions | 0 |
| Lucia | 69 sessions | 0 |
| Laravel Breeze | 45 sessions | 0 |
Being rejected is a better position than being unknown, and a cheaper one to fix. The product is already in the agent's head and on the list. Whatever ended those 430 sessions is recorded in each transcript, one reason at a time.
What to do about it in authentication
- Aim at second place first. Auth0 holds 25% and WorkOS AuthKit holds 18%. The gap between the default and the field is where the reachable sessions are.
- Pick which buyer you are for. The same authentication need written as a vibe coder landed on Google Identity, and written as an enterprise team landed on Microsoft Entra ID. Those are two markets, and the enterprise one needs pages containing the constraint words: audit log, data residency, retention, single sign-on. See how to win the enterprise persona.
- Measure per agent. Claude Code put WorkOS AuthKit first, Codex put Auth0 first, Cursor put WorkOS AuthKit first, Grok Build CLI put WorkOS AuthKit first, Muse Code put Auth0 first. A blended number for authentication describes a market that does not exist.
The work that applies to every category rather than to this one is written up separately: audit your documentation, write a quickstart an agent can follow, and how to measure install share.
Every authentication provider on this board
One page per product, with its install share, the per-agent split, and how often it was raised without being chosen.
- Do coding agents recommend Auth0? — chosen in 25% of sessions
- Do coding agents recommend WorkOS AuthKit? — chosen in 18% of sessions
- Do coding agents recommend Clerk? — chosen in 12% of sessions
- Do coding agents recommend Microsoft Entra ID? — chosen in 11% of sessions
- Do coding agents recommend Better Auth? — chosen in 4% of sessions
- Do coding agents recommend Amazon Cognito? — chosen in 3% of sessions
- Do coding agents recommend Keycloak? — chosen in 3% of sessions
- Do coding agents recommend Google Identity? — chosen in 2% of sessions
- Do coding agents recommend Arctic? — chosen in 2% of sessions
- Do coding agents recommend Ory Kratos? — chosen in 1% of sessions
- Do coding agents recommend Okta? — chosen in 1% of sessions
- Do coding agents recommend JWT? — raised in 409 sessions, chosen in none
- Do coding agents recommend Auth.js? — raised in 163 sessions, chosen in none
- Do coding agents recommend Passport? — raised in 77 sessions, chosen in none
- Do coding agents recommend Stytch? — raised in 76 sessions, chosen in none
- Do coding agents recommend Lucia? — raised in 69 sessions, chosen in none
Where these numbers come from
724 judged sessions in authentication across 17 codebases, part of a published set of 15,287. Real coding agents at pinned versions, in sandboxes, inside realistic codebases, with a simulated project owner in the loop and a blind judge on every session. The full method is on one page: how we measured this.
Every authentication run can be replayed on the board.
<!-- generated by scripts/write-data-pages.mjs -->
Common questions
How many codebases is this based on?
724 judged sessions across 17 realistic codebases. A category only runs on repositories where its seam is open, so coverage differs: some categories ran on more than ten codebases and some on two.
What authentication provider do coding agents choose?
Across 724 judged sessions, Auth0 was chosen most often, in 25% of runs. WorkOS AuthKit was second with 18%. The result changes by agent and by who is asking.
Do Claude Code and Codex pick the same authentication provider?
No. Claude Code picked WorkOS AuthKit, Codex picked Auth0, Cursor picked WorkOS AuthKit. Measuring one agent tells you about part of the market only.
How often do agents build authentication themselves instead of installing something?
In 9% of runs the agent wrote the code itself rather than adopting a product.
How can a vendor improve its position here?
Make the quickstart run when pasted, state the current version on the documentation page, use one name across product, package and import, write pages for the symptoms users describe rather than only the category name, and get into the repository through templates and framework integrations.
Which authentication providers do agents consider but never choose?
Auth.js (raised in 163 sessions, chosen in none), Passport (raised in 77 sessions, chosen in none), Stytch (raised in 76 sessions, chosen in none), Lucia (raised in 69 sessions, chosen in none), Laravel Breeze (raised in 45 sessions, chosen in none). Being considered and not chosen is a different problem from being unknown, and it is usually fixable.
Where this comes from
Armature ran 15,287 judged sessions with Claude Code, Codex, Cursor, Grok Build CLI and Muse Code inside 110 realistic codebases, and published every run. The numbers on this page come from that work.