The biggest problem with any of these "login as a service" systems is that on the web, you need to be able to set a secure (HTTPS only), server-only cookie in order to provide a persistent login. You can implement that on your own server on top of this using their API, but it makes the amount of work much closer to "rolling your own" than "paste one line of JS on your static html site hosted in s3."
The alternative is to either force a login on every visit, or store a session token in localstorage or similar, where any XSS vulnerability opens your sessions to an easy exploit. Auth0 and Stormpath, which are the 2 of these I have looked at most closely, seem to do the 2nd of those. Not sure what these guys recommend yet but I imagine it is similar.
On mobile, this does not matter as much due to better filesystem access that an app will usually be granted compared to JS in a browser tab, where you can save your API key/JSON web token/etc.
Auth is hard, but the cost-to-benefit of outsourcing seems fundamentally limited at this time due to the storage problem on the web.
The alternative is to either force a login on every visit, or store a session token in localstorage or similar, where any XSS vulnerability opens your sessions to an easy exploit. Auth0 and Stormpath, which are the 2 of these I have looked at most closely, seem to do the 2nd of those. Not sure what these guys recommend yet but I imagine it is similar.
On mobile, this does not matter as much due to better filesystem access that an app will usually be granted compared to JS in a browser tab, where you can save your API key/JSON web token/etc.
Auth is hard, but the cost-to-benefit of outsourcing seems fundamentally limited at this time due to the storage problem on the web.