You’re paying rent on the front door of your product. That rent creeps up. The landlord changes the locks. And when the building goes dark, so do you. With Cloudflare expanding self‑managed OAuth options and passkeys now native on almost every device your customers use, 2026 is the first sensible window to take back control of your identity layer—without lighting up PagerDuty.
Why now: three forcing functions you can’t ignore
- Vendor volatility and lock‑in are real. CIAM pricing has trended up, enterprise features are increasingly paywalled, and outages still happen. If your login box is a third‑party widget, your uptime and roadmap are not yours. You need an IdP exit strategy.
- Cloudflare just lowered the activation energy. With its recent announcement making self‑managed OAuth/OIDC accessible to more teams, the edge now doubles as an identity control point. Whether you terminate OAuth at the edge or forward to your own IdP, the operational scaffolding got easier.
- Passkeys are finally mainstream. Platform authenticators are widely available across iOS, Android, macOS, and Windows. FIDO/WebAuthn support now covers the vast majority of modern browsers and devices. That translates to fewer support tickets and fewer compromised accounts—if you actually ship it.
Put differently: the technology gap that justified outsourcing identity for most B2B/B2C products has narrowed. The business risk of continuing to rent the most strategic surface in your stack has grown.
Should you insource OAuth in 2026? A decision framework
Insourcing identity is not dogma. Use this filter to decide.
Green light (strongly consider insourcing) if you have:
- High‑scale consumer or SMB B2B (≥ 200k MAU) where per‑active‑user pricing or feature gating hurts unit economics.
- Multi‑tenant SaaS with bring‑your‑own‑IdP (OIDC/SAML) and fine‑grained authorization needs. You’ll want first‑party control of scopes, claims, and token lifetimes.
- Security posture requirements beyond vendor defaults (DPoP, PAR, refresh‑token rotation, step‑up auth). If you’re regulated, you’ll eventually own the responsibility anyway.
- In‑house capability to dedicate 0.5–1.0 FTE senior engineer to run the IdP and 0.25–0.5 FTE SRE for HA/DR after go‑live. That’s the honest steady state.
Yellow light (hybrid recommended) if you have:
- Enterprise SSO requirements across dozens of customer IdPs (Okta, Entra, Ping) but modest self‑serve traffic. Keep a vendor for SAML brokers; own your customer auth for self‑serve and tokens.
- Mobile‑heavy clients where you can’t easily migrate SDKs in one shot. Use an edge proxy for gradual cutover.
Red light (buy and move on) if you have:
- Complex certifications (FedRAMP High, PCI L1 as merchant, regional data residency by tenant) with no appetite to operate HSMs/KMS per region.
- No bandwidth to run a secure HA datastore for identity (multi‑region Postgres or CockroachDB + KMS + secrets rotation). Identity is either boring or a fire. There is no middle.
Architecture options that won’t nuke your roadmap
Option A: Edge‑terminated OAuth with a self‑managed core
Use the edge (e.g., Cloudflare) as the policy and session boundary. The edge:
- Handles OAuth/OIDC redirects, bot mitigation, geo/risk scoring, and device signals.
- Injects verified identity headers or a signed session token to your app.
- Forwards token issuance/validation to your IdP (Keycloak, ZITADEL, ORY) behind the scenes.
Why this works: you keep app code simple (look for headers or a signed cookie), gain latency benefits (token checks at the edge), and can swap the core IdP later without changing app contracts.
Option B: Open‑source IdP as your source of truth
Run a modern IdP you control:
- Keycloak for battle‑tested OIDC/SAML, admin UI, and SCIM. Heavy but feature‑rich.
- ZITADEL for multi‑tenant, audit‑friendly CIAM with a good developer story.
- ORY Hydra/Kratos for composable flows if you want to own UX tightly.
- Authentik for smaller teams and simpler setups.
Put it behind your edge with mTLS. Use managed Postgres with cross‑region read replicas. Store signing keys in a cloud KMS. Publish JWKS at a stable URL.
Option C: Hybrid (keep workforce SSO, own customer identity)
For B2B SaaS selling to enterprises, keep your workforce SSO on a vendor. Insourcing workforce identity is rarely ROI‑positive. But own your customer identity—tokens, scopes, and passkeys—where unit economics and UX matter.
What “good” looks like in 2026: a reference design
Protocols and flows
- OIDC with PKCE for all public clients (mobile, SPAs). Never ship the implicit flow. See RFC 7636.
- DPoP to bind tokens to the client’s key and reduce bearer theft. See RFC 9449. It’s mature enough to pilot for high‑risk APIs.
- Pushed Authorization Requests (PAR) to keep request parameters off the front channel and harden against mix‑up and tampering. See RFC 9126.
- Short‑lived access tokens (5–10 min) with rotating refresh tokens. Revoke on reuse.
- Back‑channel logout for server‑side apps; front‑channel for SPAs as a best‑effort. Plan your cache invalidation.
Passkeys and MFA
- WebAuthn passkeys first, passwords optional. Use discoverable credentials and user‑verification required. See WebAuthn L3.
- TOTP as the only fallback. Kill SMS. Keep email magic links for account recovery only with tight TTLs (≤10 minutes) and device‑binding.
- Progressive enrollment: prompt high‑intent users during success flows (post‑login, post‑purchase), not randomly at sign‑in.
- Step‑up for risky actions (payouts, key rotation, RBAC changes) requiring a recent WebAuthn assertion.
Multi‑tenant and claims
- Per‑tenant OAuth clients with isolated redirect URIs and scopes. Avoid global clients for B2B SaaS.
- Namespaced claims in ID tokens (e.g.,
https://yourco.com/roles,https://yourco.com/tenant). Keep access tokens audience‑scoped. - SCIM + JIT provisioning for enterprise tenants, but gate it behind enterprise plans to keep blast radius small.
Operations and safety
- HA/DR: multi‑AZ primary, cross‑region failover tested quarterly. Keys in KMS with region replicas. Rotate signing keys every 90 days; keep old keys in JWKS for 7 days grace.
- Observability: emit auth events in structured JSON to your SIEM. Track login success rate, median end‑to‑end auth latency, passkey enrollment %, refresh‑token reuse rate, and SSO setup time per tenant.
- Test harness: a headless browser suite that runs common flows (login, link accounts, enroll passkey, revoke session) against staging on every deploy.
A pragmatic migration plan that doesn’t brick users
1) Inventory and model the blast radius
- Enumerate every OAuth/OIDC client: app name, type (SPA/native/web), redirect URIs, scopes, audiences, SDK versions, token storage patterns.
- Map identity data: what’s in user profiles, where it lives, who writes to it (marketing vs product vs support), and what you must backfill.
- Baseline KPIs: daily login attempts, success rate, average end‑to‑end auth time, password reset volume, account takeover incidents, SSO time‑to‑live.
2) Stand up the new IdP in parallel
- Deploy your chosen IdP behind the edge with a new, versioned issuer URL (e.g.,
https://id-v2.yourco.com). - Mirror essential connections (email, SMS if you still need it for recovery, WebAuthn, SCIM). Seed a small set of pilot tenants and your own workforce accounts.
- Implement account linking: when the same user signs in via the old IdP, mint a first‑party token and silently create/link the identity in the new IdP. This lets you dual‑run.
3) Ship passkeys as an “upgrade,” not a mandate
- Gate with feature flags. Start with 5–10% of traffic where device support is highest (Chrome/Safari latest on desktop/mobile).
- Offer a one‑click enroll after a successful sign‑in. Don’t block the login wall with an enrollment demand.
- Track enrollment rate and login time deltas. Expect 20–40% of active users to enroll within 90 days if you ask at the right time and explain the benefit.
4) Strangle cutover app by app
- For server‑rendered apps: switch the edge to validate against the new issuer, keep the old IdP as a fallback path for 1–2 weeks with logs.
- For SPAs and mobile: ship SDK config updates to point at the new issuer and require PKCE. Support both token formats during a grace period by having APIs accept either issuer in their validation middleware.
- Rotate redirect URIs per client, then revoke the old client in the vendor IdP when log volume drops below 1% of baseline.
The numbers: where the ROI actually shows up
- Latency: terminating auth checks at the edge typically cuts 100–200 ms versus round‑tripping to a single US region IdP for global users. That’s measurable conversion lift on login and checkout flows.
- Support load: with passkeys, expect a material drop in “can’t sign in” tickets. Teams report 20–50% fewer password reset requests after broad passkey adoption. Your exact delta depends on audience and how aggressive you are removing passwords.
- Fraud and account takeover: passkeys plus DPoP meaningfully reduce credential stuffing and bearer token replay. Even a small reduction in ATOs repays the migration.
- Enterprise velocity: per‑tenant clients and namespaced claims cut SSO onboarding from weeks to days. If you close one extra enterprise deal per quarter, the project paid for itself.
Risks and how to contain them
- Lockouts: the existential risk. Run dark launches with mirrored traffic and simulated failures. Keep a runbook to disable DPoP/PAR per client if SDKs misbehave.
- Key management: losing keys is losing your business. Store signing keys in cloud KMS with dual control, back them up, and document emergency rotation. Publish JWKS with cache‑controlled TTLs.
- Fallback sprawl: every fallback is a future breach. Keep exactly one fallback (TOTP). Treat email magic links as recovery only.
- Regulatory surface: insourcing means you’re the processor and the controller for more fields. Minimize user profile fields, set data TTLs, and log accesses. If you promise data residency, verify your IdP datastore placement and backups enforce it.
Build vs buy: a sober TCO comparison
Assume a growth‑stage B2B SaaS with 300k MAU and enterprise SSO.
- Buy (status quo): predictable integration, quick SSO wins, but rising per‑MAU/feature costs and limited control over tokens, claims, and UX. You carry vendor outage and lock‑in risk.
- Self‑manage: expect 0.5–1.0 FTE senior engineer to own the IdP plus 0.25–0.5 FTE SRE for HA/DR. Infra: two mid‑sized Postgres instances across regions, edge workers, metrics/alerts. After stabilization, ongoing velocity is features you want (passkeys, step‑up, DPoP) instead of waiting on a roadmap.
We’ve seen teams reach breakeven within 9–15 months when they already have edge infrastructure, and faster if unit economics are sensitive to per‑active‑user fees. If your login is conversion‑critical (consumer media, fintech onboarding), the UX and latency wins alone can justify the move.
What to hand your team on Monday
- Pick your posture: Edge‑terminated + self‑managed core (A) or hybrid (C) for most B2B SaaS. Avoid bespoke flows; stick to OIDC + PKCE.
- Choose an IdP: ZITADEL for multi‑tenant CIAM, Keycloak for feature breadth, ORY if you need composability. Decide this week; you can swap later behind the edge.
- Define token policy: 5–10 min access tokens, rotating refresh tokens, audience scoping, namespaced claims, DPoP for high‑risk APIs, PAR for all confidential clients.
- Stand up staging: IdP + edge + Postgres HA + KMS. Publish JWKS. Wire logs to your SIEM. Build a headless auth test suite.
- Add passkeys: Implement WebAuthn with discoverable credentials and strict user verification. Keep TOTP as fallback. Plan progressive enrollment UX.
- Ship an account‑linking bridge: Accept old IdP tokens, mint first‑party sessions, create linked identities in the new IdP in the background.
- Pilot with internal accounts and 1–2 friendly tenants: Measure login latency, success rate, and enrollment. Fix the papercuts.
- Cut over low‑risk apps first: Server‑rendered admin UI, then SPA, then mobile. Keep a two‑week dual‑issuer grace at the API layer.
- Kill fallbacks deliberately: Remove passwords for cohorts that have enrolled passkeys. Enforce step‑up on sensitive flows.
- Write the runbook: Key rotation, emergency rollback, tenant cutover checklist, and an on‑call script for widespread login failures.
“But what about social logins and enterprise SSO?”
Keep them. Your IdP should act as a broker for OIDC/SAML/social providers. For B2C, social is a convenience path to get users in the door; convert them to passkeys on day one post‑login. For B2B, enterprise SSO stays, but make each tenant’s connection a first‑class client with isolated redirect URIs and scopes so one tenant’s misconfig can’t brick another’s users.
Nearshore leverage: how to execute without stalling core product
This is where a seasoned nearshore pod earns its keep. Give a Brazil‑based platform team a clear charter: harden the edge, stand up the IdP, wire passkeys, and deliver the migration harness with zero app rewrites. You reserve your core product squads for roadmap features. With 6–8 hours of overlap and lower TCO, you get an IdP you own without a quarter of feature freeze.
Where to start reading (and what to copy, not invent)
- Cloudflare’s announcement on expanding self‑managed OAuth/OIDC support to more teams is a signpost: the edge is your new identity boundary. Use it.
- Copy the specs, don’t reinterpret: PKCE, PAR, DPoP, and WebAuthn.
- Pick one IdP and ship. Keycloak and ZITADEL both have sane defaults for OIDC, passkeys, and multi‑tenant.
The bottom line
Identity is a product surface you should own. In 2026, the tooling, browser support, and edge primitives are finally good enough that you can. If you’re still renting your login box, build an exit ramp now—before pricing changes or an outage forces your hand.
Key Takeaways
- Self‑managed OAuth is now practical: use the edge as your identity boundary and keep apps simple.
- Ship passkeys as the default; keep exactly one fallback (TOTP). Expect fewer resets and fewer ATOs.
- Adopt PKCE, PAR, and DPoP. Short‑lived access tokens with rotating refresh tokens are table stakes.
- Strangle‑migrate by app, dual‑run issuers with logs, and test flows end‑to‑end with headless browsers.
- Own customer identity (CIAM); keep workforce SSO on a vendor unless you have a strong reason not to.
- Nearshore pods can deliver the IdP and edge integration without freezing core product teams.