[latchkey]

Definitely this.

Edit: let me expand on why. You get to take advantage of the power of all of google's security team, with a nice clean simple api, great client libraries and excellent documentation.

There is also some cool features like the ability to tie custom data to a user (claims) and integrate with the realtime datastore for immediate notifications about changes to the user.

There is some great examples on how to implement this in the docs. I implemented this in my own app so that when I enable a 'role' for a user, the app literally updates (in both a Flutter mobile and React webapp) without even a refresh of the window. Pretty epic UX and super painless to implement.

Oh and it is effectively free.

[sergiotapia]

Non-starter. You're giving all your user information to Google. If you're OK with that, go for it. A lot of people are not.

[latchkey]

I hear you. It really depends on your requirements. That said, any site that is currently enabling 'google login' or 'xyz login' other than just a standard email login is already doing this. Never mind the fact that significant numbers of users are already on gmail or google apps.

The trade-off being that you can run the risk of a security hole in your authentication flow.

I still miss Mozilla Persona.

I also looked up the terms... this is the only thing I noticed that was relevant... 'except as necessary' is pretty vague, but I'd take that to mean that they should probably inform you first.

https://cloud.google.com/terms/

5.2 Use of Customer Data. Google will not access or use Customer Data, except as necessary to provide the Services and TSS to Customer.