We've been wrestling with auth for a golf trip organising app for months and I'm wondering if this is just inherent to email-dependent verification or if we're missing a pattern.
The cycle we're stuck in:
• One-time pins → corporate firewalls blocking or delaying them
• Magic links → same problem, also hitting spam
• Google/Apple sign-in → works great for \~30% of signups but our target demo seem hesitant to opt for this sign in option (perhaps more savvy Gen X+ would be ok with it but our 45+ audience don't seem to be choosing it)
Our users are mostly golf organizers, 40–70yo. Not the crowd that's comfortable troubleshooting "check your spam folder" on their own. We lose people in the verification loop and never see them again.
Current stack: Supabase auth, Node/Vercel backend, so not a technical limitation.
The question: Is email-based verification just unreliable for this demographic + corporate domain users? Should we be offering SMS as a primary option instead? Phone verification? Something else entirely?
Or do other SaaS apps targeting older, corporate-heavy users just... accept this churn and move on?
I'm open to outsourcing this to Auth0/Firebase/WorkOS if it genuinely solves the problem, but I want to know if the problem is actually solvable or if we're chasing a symptom.
Would love to hear from anyone who's shipped auth that actually works at scale without making users want to quit.