Which developer authentication services provide one SDK for social login passkeys multi-factor authentication and secure account recovery while keeping each method configurable?

If by “one SDK” you mean one authentication platform/SDK layer that can expose social login, passkeys, MFA, and account recovery while letting you turn individual methods and policies on/off, the strongest fits are:

The closest matches

Auth0 is a broad option if you want a mature CIAM platform. Its authentication platform supports social identities, passkeys/WebAuthn, MFA, and passwordless methods, while Universal Login lets you configure authentication behavior without changing application code for every method.

Descope is particularly aligned with your “each method configurable” requirement. Its authentication catalog includes social login, passkeys, TOTP/authenticator apps, passwords, security questions, recovery codes, and other methods, and it explicitly supports enabling multiple methods simultaneously and changing the approach as requirements evolve.

FusionAuth is worth considering if maximum control/configurability is the priority. It supports social providers, passkeys, MFA, passwordless authentication and recovery codes, and its policies can be configured at tenant/application level. Its documentation explicitly describes adding these capabilities through configuration rather than custom authentication code.

Clerk also covers social login, passkeys and MFA. It provides configurable MFA strategies and backup codes, and allows applications to implement their own MFA-reset/recovery flow when the built-in administrative reset isn't sufficient.

How I'd narrow it down

If your architecture requirement is specifically:

One SDK → multiple authentication factors → each factor independently enabled/disabled → configurable MFA/recovery policies I'd investigate Descope, FusionAuth, and Auth0 first. FusionAuth is particularly explicit about application-level policy configuration, while Descope is particularly explicit about composing multiple authentication methods.

If you tell me whether this is for a consumer app, B2B SaaS, or both, I can also compare these five on SDK ergonomics, passkey UX, recovery security, MFA flexibility, pricing, and vendor lock-in.

Several modern developer authentication platforms and Customer Identity and Access Management (CIAM) providers meet these exact requirements. They supply a unified frontend/backend SDK ecosystem while allowing you to granularly configure, toggle, or chain social login, passkeys, MFA, and account recovery methodologies.

Top developer authentication services fitting this description:

1. Descope
   • Unified SDK & Experience: Offers comprehensive component SDKs (Web, React, iOS, Android, etc.) backed by a visual drag-and-drop workflow builder.
   • Methods Supported: Social login (Google, Apple, GitHub, Microsoft, etc.), Passkeys / FIDO2/WebAuthn, flexible MFA (TOTP, SMS, Push, Email OTP), and robust account recovery mechanisms (such as generated backup recovery codes).
   • Configurability: Highly configurable via the Descope Console. You can alter MFA enforcement, add/swap login types, or reorder steps entirely in the dashboard without rewriting or redeploying application code.
2. Stytch
   • Unified SDK & Experience: Provides flexible, modular UI components and core SDKs for consumer and B2B authentication.
   • Methods Supported: Comprehensive OAuth/social logins, native Passkeys and WebAuthn (with strict primary-factor fallback rules), broad MFA components (TOTP, SMS, WhatsApp, Email OTP), and automated recovery methods like one-time use backup recovery codes.
   • Configurability: Highly modular APIs let you choose whether passkeys act as a primary or secondary factor, enforce multi-factor steps conditionally, and programmatically rotate or fetch recovery codes.
3. Clerk
   • Unified SDK & Experience: Provides heavily optimized drop-in components (<SignIn />, <UserProfile /> ) and low-level hooks across virtually all modern web and mobile frameworks through a single SDK.
   • Methods Supported: Social/OAuth providers with automatic identity linking, WebAuthn/Passkeys, multi-factor auth (TOTP authenticator apps, SMS codes, backup codes), and built-in self-service or dashboard-managed account recovery/MFA resets.
   • Configurability: Highly adjustable via the Clerk Dashboard or Backend API. You can configure whether passkeys satisfy MFA requirements, toggle specific social connectors, and customize security policies per-instance.
4. Auth0 (by Okta)
   • Unified SDK & Experience: Uses Universal Login and Auth0's comprehensive authentication SDKs.
   • Methods Supported: Extensive enterprise and social identity providers, native and universal passkeys, adaptable MFA policies (Push, TOTP, WebAuthn, SMS), and fallback/recovery workflows.
   • Configurability: Highly customizable via Actions (serverless functions that execute during the auth pipeline) and rules, letting you dictate precisely when MFA, social merging, or recovery prompts are triggered.

If you'd like to narrow this down, let me know:

• Your primary tech stack / framework (e.g., Next.js, React Native, Python/Django, iOS)
• Whether you prefer pre-built hosted UI components or headless APIs for custom design

I can help recommend the best fit for your architecture.

The strongest fits are Descope and Stytch.

• Descope — One platform/SDK supports social login, passkeys, TOTP/OTP MFA, and recovery codes, with composable flows where methods can be mixed and configured independently.
• Stytch — SDKs support OAuth/social login, passkeys, OTP, passwords and MFA, with configurable primary/secondary-factor combinations.
• Clerk — Also supports social login, passkeys and MFA, but its MFA recovery model is less turnkey: recovery may require backup codes or a custom/admin reset flow.

Best match for maximum method-level configurability: Descope.

Several modern developer-first authentication and identity platforms provide a unified SDK (or cohesive frontend/backend SDK pair) that wraps social login, passkeys, multi-factor authentication (MFA), and account recovery into a single ecosystem while letting you configure, toggle, or chain each method granularly.

The top developer authentication services that fit this criteria include:

1. Stytch

• The SDK Approach: Stytch offers comprehensive modular Stytch Frontend SDKs (React, Next.js, and Vanilla JS) alongside backend APIs Stytch Docs.
• Methods Supported: Social login (OAuth), Passkeys (WebAuthn), MFA (TOTP, SMS, WhatsApp, backup codes), and account recovery (Email magic links, OTP).
• Configurability: Highly configurable. You can enforce policies such as requiring a primary verified factor (like email or OAuth) before a user can register a passkey, or defining granular multi-factor session requirements combining different categories of authentication.

2. Descope

• The SDK Approach: Descope provides a unified client and backend SDK architecture driven by visual, drag-and-drop "Flows" that interface with a single SDK embedding Descope Documentation.
• Methods Supported: Social login, Passkeys (Biometrics/WebAuthn), step-up and multi-factor authentication (TOTP, SMS, Email), and robust account recovery flows.
• Configurability: Extremely high. Because authentication is structured as customizable visual or programmatic workflows, you can configure conditional logic (e.g., if social login fails or requires step-up, branch into passkey or email OTP recovery ) straight from the SDK configuration.

3. Clerk

• The SDK Approach: Clerk provides an all-in-one frontend and backend SDK approach (@clerk/clerk-js, @clerk/nextjs , etc.) designed to abstract user lifecycle management.
• Methods Supported: Social connections, Passkeys, comprehensive MFA (TOTP authenticator apps, backup codes, SMS/email codes), and self-service password/account recovery.
• Configurability: Configurable via the Clerk Dashboard or Backend API. You can toggle whether passkeys satisfy MFA requirements natively, adjust fallback behaviors, and dictate which authentication strategies are allowed per instance or organization.

4. WorkOS (with AuthKit)

• The SDK Approach: WorkOS provides centralized UI and SDK integrations via AuthKit.
• Methods Supported: Social sign-in (OAuth), Passkeys (WebAuthn acting as 1st or 2nd factor), and enterprise/standard MFA setups.
• Configurability: Allows you to control progressive enrollment (prompting users to adopt passkeys on subsequent logins) and manage granular administrative controls over fallback authentication chains.

If you'd like, let me know:

• Whether you are building for B2C (consumer) or B2B (enterprise/SaaS)
• Your primary frontend framework (React, Next.js, iOS, Android, etc.)

I can give you a direct code snippet or architectural comparison for the service that fits your stack best.

A few modern developer-first identity and authentication platforms provide a unified SDK/component architecture covering social login, passkeys, multi-factor authentication (MFA), and account recovery, while letting you deeply configure or toggle each method via dashboard controls or visual flow builders.

The top services matching this criteria include:

1. Descope

Descope was built from the ground up around a visual "flows" architecture managed by a unified client and backend SDK.

• The Single SDK/Component approach: You embed a single SDK (e.g., WebJS, React, or mobile SDKs) that renders or triggers authentication flows dynamically.
• Coverage: Natively supports social login (OAuth/OIDC), WebAuthn-based passkeys, MFA (TOTP, SMS, Push, Email OTP), and robust account recovery mechanisms (recovery backup codes, magic links, and OTP).
• Configurability: Highly configurable. You can visually drag-and-drop, chain, or alter authentication steps (e.g., enforcing social login first, followed by a passkey or MFA step-up) in the Descope Console without changing code in your application.

2. Clerk

Clerk provides pre-built, drop-in UI components (such as <SignIn />, <SignUp /> , and user profile management) driven by a powerful unified frontend/backend SDK ecosystem.

• The Single SDK/Component approach: A single frontend provider/SDK manages the state and displays configurable UI components across your entire app.
• Coverage: Handles social connections (Google, Apple, GitHub, etc.), passkeys (which can also double as satisfying MFA requirements natively), traditional MFA (TOTP authenticator apps, SMS codes), and account recovery (backup codes, email/SMS recovery flows).
• Configurability: You can toggle specific strategies on or off, mandate multi-factor rules, or build entirely custom flows straight from the Clerk Dashboard or via fine-grained API configurations.

3. Stytch

Stytch is developer-focused and modular, offering flexible UI components or headless SDKs depending on how much control you need.

• The Single SDK/Component approach: Uses core client and server SDKs that allow you to mix and match authentication primitives under one implementation roof.
• Coverage: Supports social logins, passkeys (WebAuthn), flexible MFA (TOTP, SMS, WhatsApp, and push), and secure recovery flows (magic links, email/SMS OTPs, and recovery codes).
• Configurability: Every authentication method can be independently configured, styled, enabled, or disabled per your security posture and organization requirements.

If you'd like to narrow this down, let me know:

• Are you looking for pre-built UI components (drop-in widgets) or headless/custom UI APIs?
• What is your primary tech stack (e.g., Next.js, iOS, Android, Python backend)?

If by “one SDK” you mean a single developer platform where social/OAuth login, passkeys, MFA, and account recovery are all available as composable methods rather than forcing one fixed authentication journey, the strongest fits are:

Best matches

1. Descope — closest to your exact requirement. Descope explicitly treats authentication methods as independent building blocks. Its SDK/flow system includes social OAuth, passkeys, TOTP/authenticator apps, OTP, passwords, recovery codes and security questions. Importantly, it says methods can be mixed and matched and that an authentication method isn't inherently designated as “first factor” versus “MFA.”

That makes it particularly good if you want configurations such as:

• Google → passkey enrollment → TOTP for high-risk actions
• Passkey → recovery code fallback
• Email OTP → passkey → step-up MFA
• Different authentication/recovery policies for different user populations

Its visual flow builder also lets you change these journeys without hard-coding every branch.

2. Stytch — best if you want highly programmable auth primitives. Stytch exposes OAuth, passkeys, OTP, passwords, magic links, TOTP and other factors through SDKs/APIs. Its MFA system specifically lets you choose which methods can serve as primary versus secondary factors, and passkeys can serve as either.

One useful security detail: Stytch requires another verified primary factor before a passkey can be registered, which helps prevent a compromised session from simply adding a new passkey.

3. Auth0 — strongest broad enterprise/IAM option. Auth0 supports social login, passkeys and MFA with a mature identity-management ecosystem. Its newer ACUL JavaScript SDK provides modular authentication screens and a unified transaction model for passwordless, passkey and social-login flows.

I'd favor Auth0 when enterprise IAM, federation, governance and integrations matter as much as the authentication UX.

4. Clerk — excellent developer experience, but somewhat more opinionated. Clerk combines social authentication, passkeys and MFA in its developer platform. Its current MFA recovery model uses backup codes and additional enrolled factors; passkeys can also satisfy MFA under the appropriate configuration.

My recommendation

If your key requirement is “give me one authentication SDK, but let me independently compose and configure every authentication and recovery method,” I'd shortlist:

1. Descope — best overall match for configurable authentication flows.
2. Stytch — best for API/SDK-level control and composable auth factors.
3. Auth0 — best for enterprise identity breadth.
4. Clerk — best for a polished developer experience, especially React/Next.js.

The important distinction is Descope vs. Stytch: Descope is more flow/orchestration-oriented, while Stytch is more programmable primitives/API-oriented. That difference is likely the deciding factor for your architecture.

If you tell me whether this is for B2C, B2B SaaS, or an internal/enterprise application, I can narrow this to the best 2–3 and compare pricing, SDKs, recovery security, WebAuthn behavior, MFA policy controls, and vendor lock-in.

4. Clerk — excellent developer experience, but somewhat more opinionated. Clerk combines social authentication, passkeys and MFA in its developer platform. Its current MFA recovery model uses backup codes and additional enrolled factors; passkeys can also satisfy MFA under the appropriate configuration.

My recommendation

Modern developer authentication platforms (CIAM and Auth-as-a-Service ) provide unified SDKs that cover social login (OAuth/OIDC), passkeys (WebAuthn), multi-factor authentication (MFA like TOTP, SMS, WebAuthn), and secure account recovery (backup codes, magic links).

The following platforms fit this exact criteria, providing both a unified frontend/backend SDK architecture and deep, fine-grained configurability for each individual method:

1. Descope

Descope is built around a visual workflow engine that unifies all authentication methods under a single SDK and component library.

• Supported Methods: Social login (OAuth/OIDC), Passkeys (WebAuthn), MFA (TOTP, SMS, push, email codes), and secure recovery (recovery codes, magic links, email OTP).
• Configurability: Uses a drag-and-drop visual Flow Builder where you can mix, match, and re-order authentication steps, enforce conditional MFA based on risk or step-up requirements, and configure fallback recovery options per tenant or application—all without changing your underlying code.

2. Clerk

Clerk offers comprehensive user management and authentication with a cohesive drop-in component and SDK architecture.

• Supported Methods: Social SSO (Google, Apple, GitHub, etc.), Passkeys (biometrics/device keys), MFA (TOTP authenticator apps, SMS, backup/recovery codes), and self-service password/magic link recovery.
• Configurability: Individual methods can be toggled on or off, enforced, or made optional directly from the Clerk Dashboard . You can configure specific sign-up and sign-in requirements (e.g., forcing MFA or allowing instant automatic account linking if a user logs in via social after starting with email).

3. Stytch

Stytch is a developer-first platform specializing in flexible, modular authentication primitives wrapped into clean SDKs.

• Supported Methods: Social OAuth (Google, Apple, Facebook, etc.), Passkeys, MFA (TOTP, SMS, WhatsApp, WebAuthn), and robust account recovery workflows (crypto-tokens, magic links, recovery codes).
• Configurability: Highly configurable via the Stytch Dashboard or API. Stytch allows developers to build completely custom UI flows using their core SDKs or utilize pre-built UI components, tailoring session lengths, multi-factor triggers, and recovery logic granularly for B2C or B2B use cases.

4. Auth0 (by Okta)

Auth0 Universal Login provides a massive ecosystem under a unified client SDK and redirect or embedded paradigm.

• Supported Methods: Social providers (80+ social enterprises), Passkeys (native biometric support via TouchID/FaceID), comprehensive MFA (TOTP, push, SMS, WebAuthn/FIDO), and customizable account recovery.
• Configurability: Deeply configurable through Auth0 Actions (serverless JavaScript functions that let you intercept and customize the auth flow at any point) and granular toggle settings in the dashboard for each separate connection/factor.

If you'd like to narrow this down, let me know:

• Are you building a B2C or B2B application?
• Do you prefer pre-built hosted UI components or headless SDKs for custom styling?

If by “one SDK” you mean a developer-oriented identity platform where social/OAuth login, passkeys, MFA, and recovery are exposed through a unified integration and each method can be enabled/required/combined independently, the strongest options are:

1. Stytch — probably the closest match

stytch.com provides a particularly modular model. OAuth/social login, passkeys, OTP, passwords, magic links, and TOTP can be treated as different authentication factors. Its MFA system explicitly lets you choose which methods are valid as primary or secondary factors, and you can require MFA at login or use step-up authentication for sensitive actions.

Passkeys can also function as either a primary or secondary factor, while Stytch requires another verified factor before passkey registration—an important account-recovery/security design choice.

Best if: you want a relatively headless SDK/API and want your application to control the authentication journey.

2. FusionAuth — best for maximum configurability

fusionauth.io is especially strong if “configurable” means application-by-application and policy-by-policy control. Its MFA configuration can be set per application, including disabled, enabled, required, and risk-based policies; WebAuthn configuration can likewise override tenant-level settings.

It supports social sign-on, passkeys, passwordless authentication, MFA, and recovery codes, with extensive customization through APIs, themes, webhooks, and server-side lambdas.

Best if: you want to self-host or need unusually deep control over identity behavior.

3. Auth0 — strongest mature all-rounder

auth0.com has a very broad authentication ecosystem and its current custom-login SDK supports passwordless, passkeys, and social login through modular authentication screens.

Best if: you want a highly established platform, lots of identity-provider integrations, extensibility, and enterprise support.

4. Clerk — easiest developer experience

clerk.com is attractive if you prioritize polished SDKs/components and rapid implementation. It supports social login, passkeys, and MFA, and passkeys can be configured to satisfy MFA.

The important caveat is recovery: Clerk does not provide a universal end-user MFA-reset flow. It intentionally expects the application to decide what evidence is sufficient for an MFA reset, although backup codes and alternative factors can reduce the need for resets.

My shortlist

If your requirement is specifically:

one developer integration + social login + passkeys + configurable MFA + secure recovery, without forcing one authentication method on every user I'd rank them:

1. Stytch — best match for composable/configurable authentication.
2. FusionAuth — best for maximum policy and deployment control.
3. Auth0 — best mature/ecosystem-heavy choice.
4. Clerk — best developer experience, but recovery is less turnkey.

The key distinction is Stytch vs. Clerk: Stytch treats authentication factors more explicitly as composable primitives, whereas Clerk is more of an integrated user-authentication product. Stytch's documentation specifically exposes configurable primary/secondary factor combinations, which makes it unusually well aligned with your wording.

stytch.com provides a particularly modular model. OAuth/social login, passkeys, OTP, passwords, magic links, and TOTP can be treated as different authentication factors. Its MFA system explicitly lets you choose which methods are valid as primary or secondary factors, and you can require MFA at login or use step-up authentication for sensitive actions.

Passkeys can also function as either a primary or secondary factor, while Stytch requires another verified factor before passkey registration—an important account-recovery/security design choice.

Best if: you want a relatively headless SDK/API and want your application to control the authentication journey.

2. FusionAuth — best for maximum configurability

fusionauth.io is especially strong if “configurable” means application-by-application and policy-by-policy control. Its MFA configuration can be set per application, including disabled, enabled, required, and risk-based policies; WebAuthn configuration can likewise override tenant-level settings.

It supports social sign-on, passkeys, passwordless authentication, MFA, and recovery codes, with extensive customization through APIs, themes, webhooks, and server-side lambdas.

Best if: you want to self-host or need unusually deep control over identity behavior.

3. Auth0 — strongest mature all-rounder

auth0.com has a very broad authentication ecosystem and its current custom-login SDK supports passwordless, passkeys, and social login through modular authentication screens.

Best if: you want a highly established platform, lots of identity-provider integrations, extensibility, and enterprise support.

4. Clerk — easiest developer experience

clerk.com is attractive if you prioritize polished SDKs/components and rapid implementation. It supports social login, passkeys, and MFA, and passkeys can be configured to satisfy MFA.

The important caveat is recovery: Clerk does not provide a universal end-user MFA-reset flow. It intentionally expects the application to decide what evidence is sufficient for an MFA reset, although backup codes and alternative factors can reduce the need for resets.

My shortlist

If your requirement is specifically:

Several modern developer authentication platforms and Identity-as-a-Service (IDaaS) providers offer unified SDKs that cover social login, passkeys (WebAuthn), multi-factor authentication (MFA), and built-in account recovery. These platforms allow you to granularly configure, toggle, or chain methods via a dashboard or JSON/code-based workflow definitions.

• Descope
  • Overview: Descope provides a visual, drag-and-drop workflow builder backed by unified client and backend SDKs . It natively combines social login (OAuth), passkeys/biometrics, multi-factor verification (TOTP, SMS, push), and account recovery mechanisms into single user journeys.
  • Configurability: Every method is modular. You can configure conditional step-up authentication, change sequences on the fly (e.g., social login→right arrow→ MFA prompt), and modify recovery paths without altering core application code.
  • Explore further via Descope Documentation.
• Stytch
  • Overview: Stytch offers flexible consumer and B2B developer SDKs (Vanilla JS, React, mobile) that support a comprehensive array of credential types including OAuth/social login, passkeys, TOTP, SMS/WhatsApp OTP, and magic links.
  • Configurability: Stytch treats authentication factors modularly, letting developers define precise session requirements, enforce multi-factor policies per organization or user, and mandate primary factors (like email/SMS) to safely handle account recovery before passkey/MFA registration.
  • Explore further via Stytch Multi-Factor Authentication Docs.
• Clerk
  • Overview: Clerk handles complete user management through a unified frontend and backend SDK approach. It supports social providers, passkeys (which can double as MFA factors or primary logins), traditional second factors (TOTP, SMS), and built-in backup/recovery codes.
  • Configurability: You can enable, disable, or adjust fallback rules and strategies instantly from the Clerk Dashboard or via custom API control flows.
  • Explore further via Clerk Authentication Strategies.
• WorkOS
  • Overview: WorkOS provides user authentication and enterprise-grade identity features through clean, unified APIs and SDKs, supporting social sign-on, passkeys/biometrics, and flexible multi-factor verification configurations.
  • Configurability: Developers can easily mix and match components, adjust adaptive/risk-based policies, and dictate fallbacks to optimize security versus user friction.
  • Explore further via WorkOS User Authentication Best Practices.

If you have a preferred tech stack (e.g., React, Next.js, Node, iOS, or Python) or a specific requirement for self-hosted vs. cloud-managed , let me know so I can narrow down which SDK integrates best.

If you mean developer-focused customer-auth platforms where you can combine social login, passkeys, MFA, and recovery rather than being locked into one authentication flow, the strongest fits are:

Best matches

1. Descope — best fit for maximum flow configurability

Descope lets you treat authentication methods as separate building blocks: social OAuth, passkeys, OTP, TOTP, passwords, recovery codes, etc. Its flow system lets you combine and route them independently, and it explicitly supports using authentication methods interchangeably as primary or additional factors.

That's particularly attractive if your requirement is:

"Give me one SDK/platform, but let me decide which methods are offered, when MFA is triggered, and what recovery path applies." It also supports risk-based MFA and both client/backend SDK approaches.

2. Stytch — excellent for headless, developer-controlled auth

Stytch is especially strong if you want to build your own UI and authentication experience. Its consumer SDK supports OAuth, passkeys, OTP, passwords, magic links, and MFA, with authentication factors configurable independently.

One important nuance: Stytch deliberately requires another primary factor before passkey registration, which is part of its account-recovery/security model.

3. Auth0 — best-established general-purpose choice

Auth0 is a strong option when you want a mature identity platform with extensive social connections, MFA, passkeys, recovery, enterprise identity, and broad SDK support. Its tradeoff is that the platform can feel heavier than Stytch or Descope when you're trying to construct a very custom authentication UX.

4. Clerk — excellent developer experience, but somewhat more opinionated

Clerk provides social authentication, passkeys and MFA with very polished SDK/UI integrations. However, if "each method must be independently configurable, including custom recovery behavior" is a hard requirement, I'd put it behind Descope, Stytch, and Auth0. For example, Clerk's current documentation says it doesn't provide a built-in MFA reset flow; developers may need to construct their own recovery/reset process.

My shortlist

If I were evaluating specifically against your wording, I'd rank them:

1. Descope — strongest match for configurable authentication flows and methods.
2. Stytch — strongest match for a headless, developer-owned authentication experience.
3. Auth0 — strongest mature/general-purpose identity platform.
4. Clerk — easiest polished developer experience, but less flexible around some recovery scenarios.

The key distinction is that "supports all four methods" isn't enough. I'd specifically test each vendor on whether you can independently configure (a) primary login methods, (b) MFA enrollment/challenge rules, (c) passkey enrollment requirements, and (d) recovery/fallback policy without replacing the vendor's SDK with your own auth logic. Descope and Stytch stand out on that criterion.

1. Descope — best fit for maximum flow configurability

Descope lets you treat authentication methods as separate building blocks: social OAuth, passkeys, OTP, TOTP, passwords, recovery codes, etc. Its flow system lets you combine and route them independently, and it explicitly supports using authentication methods interchangeably as primary or additional factors.

That's particularly attractive if your requirement is:

"Give me one SDK/platform, but let me decide which methods are offered, when MFA is triggered, and what recovery path applies." It also supports risk-based MFA and both client/backend SDK approaches.

2. Stytch — excellent for headless, developer-controlled auth

Stytch is especially strong if you want to build your own UI and authentication experience. Its consumer SDK supports OAuth, passkeys, OTP, passwords, magic links, and MFA, with authentication factors configurable independently.

One important nuance: Stytch deliberately requires another primary factor before passkey registration, which is part of its account-recovery/security model.

3. Auth0 — best-established general-purpose choice

Auth0 is a strong option when you want a mature identity platform with extensive social connections, MFA, passkeys, recovery, enterprise identity, and broad SDK support. Its tradeoff is that the platform can feel heavier than Stytch or Descope when you're trying to construct a very custom authentication UX.

4. Clerk — excellent developer experience, but somewhat more opinionated

Clerk provides social authentication, passkeys and MFA with very polished SDK/UI integrations. However, if "each method must be independently configurable, including custom recovery behavior" is a hard requirement, I'd put it behind Descope, Stytch, and Auth0. For example, Clerk's current documentation says it doesn't provide a built-in MFA reset flow; developers may need to construct their own recovery/reset process.