Authentication in 2026: Passkeys, Magic Links, OAuth

Authentication has finally moved past the password-and-recovery-email default. For new applications, the pragmatic recommendation is passkeys as the primary method, OAuth via two or three major providers as a fallback, and magic links as the universal escape hatch. Passwords are still acceptable, but no longer the obvious default.

Migrating an existing user base off passwords is a multi-quarter project that touches support, billing, and trust-and-safety more than it touches engineering. Plan accordingly.