September 2022 Summaries

User authentication extends beyond login methods to include account management, password updates, two-factor authentication, and profile settings, while B2B applications must additionally support organizations, invitations, role-based permissions, and reusable authorization controls that vary by organization. As companies scale, enterprise customers often require single sign-on through identity providers such as Google Workspace, Rippling, or OneLogin, typically using SAML to automate employee access and revocation. However, SAML integrations can be difficult because identity providers implement the protocol differently and require exchanging configuration details, making self-service setup and testing important. PropelAuth presents its platform as a way for B2B startups to avoid building these capabilities internally by providing hosted authentication, organization management, roles, and guided SAML configuration workflows.

Tennr co-founder Trey Holterman chose to adopt authentication early rather than build it internally, citing the complexity, time, and specialized knowledge required to create secure login, 2FA, role-based access control, and organization features while developing an MVP. Although he considered Auth0, Firebase, and Memberstack, he found that their primarily B2C-oriented offerings would still require significant custom work for Tennr’s B2B needs, including team management and client-facing consoles. Tennr selected PropelAuth for its B2B-focused features, Next.js compatibility, alternative sign-in methods, built-in team management, clear documentation, and direct support, enabling the company to launch authentication in roughly half a day. By outsourcing authentication, Tennr focused its resources on its data-led engagement platform and later added SAML support to better serve enterprise customers.

The company has expanded its SAML single sign-on support to include Azure Active Directory alongside identity providers such as Okta, JumpCloud, and OneLogin. Its SAML integration enables customers to offer enterprise SSO within their products, while self-service setup wizards provide tailored, step-by-step instructions for configuring and testing connections with each provider’s distinct interface and terminology. The Azure AD wizard is intended to simplify navigation of Azure’s complex console, allowing end users to independently manage SAML connections without requiring assistance from the product team.

PropelAuth has released its SAML, or Enterprise SSO, integration from beta for all customers, enabling B2B products to let organizations authenticate users through identity providers such as Okta, Google, OneLogin, and JumpCloud. SAML connects a company’s centralized employee-management system with a software service, allowing access and roles to be automatically assigned as employees join or change within an organization, rather than relying on manual invitation workflows. The capability is often an enterprise purchasing requirement and can improve security for organizations of any size by centralizing account access management. PropelAuth’s implementation builds on its organization and role features, provides hosted self-service setup instructions and testing flows for customers, and abstracts SAML complexity so application code can simply determine a user’s organizational membership. Providers can make SAML available to all customers or selectively enable it through the dashboard or APIs.

Product-led growth is a strategy in which a product drives customer acquisition, adoption, and advocacy by delivering clear value with minimal friction. It emphasizes allowing prospective users to try and evaluate a product independently through accessible sign-up, transparent pricing, straightforward onboarding, and self-service features rather than requiring sales-led demos. This approach is especially relevant for developer tools, whose users often prefer hands-on evaluation and dislike opaque pricing, restrictive plans, or manipulative design patterns. GitHub exemplifies this model by allowing users to access substantial functionality before payment and making it easy to invite colleagues, encouraging wider organizational adoption. PropelAuth applies similar principles by offering a public demo of its customizable hosted user interfaces and providing built-in invitation, organization, domain-based grouping, and self-service management capabilities that help its customers grow through their own products.

Amid economic uncertainty, layoffs, hiring freezes, and tighter venture funding, early-stage founders are encouraged to control spending while continuing to build products and acquire customers through free tools. Suggested resources include Sentry, Rollbar, and Datadog for error monitoring; PropelAuth for startup authentication; Slack for team communication and community support; AWS Activate for cloud credits; Linear for project management; and Pipedream for workflow automation. LinkedIn can help founders expand their networks and find niche contacts, while Amplitude offers product analytics and specialized support for eligible startups, including Black founders. Dev.to and Medium are recommended as publishing platforms for establishing credibility, reaching audiences, and directing SEO traffic back to a company’s website.

Multi-tenant applications allow multiple organizations to share application infrastructure while requiring strong controls to prevent users from accessing another tenant’s data. The walkthrough builds a B2B posting application with Next.js, Prisma, and PropelAuth, where users can create and view posts only within organizations they belong to, including support for users who participate in multiple organizations through organization-specific URL paths. Next.js dynamic routes identify the requested organization, while PropelAuth supplies hosted signup, organization management, membership checks, and access tokens for authenticated requests. Although frontend membership checks improve usability by displaying “Not found” for unauthorized organization pages, backend enforcement is essential because client-side restrictions alone do not secure data. Next.js API routes verify access tokens and organization membership before querying or creating Prisma-managed database records, assigning both organization and user IDs to each post. Testing confirms that unauthenticated requests receive 401 errors and authenticated users attempting to access organizations they do not belong to receive 403 errors, illustrating a layered approach to tenant isolation.