Stormpath

» see stormpath.com as it lived, on the wayback machine

~ the obituary ~

Authentication is the part of an application nobody wants to write and everybody has to. Password hashing, reset emails, sessions, account lockout, the eventual demand for Google login and the eventual demand for two factor. None of it is the thing you are actually building, all of it will be audited, and getting it subtly wrong is how a company ends up in the news.

Stormpath sold the way out. Alex Salazar and Les Hazlewood founded it in San Mateo in 2011 with a REST API that held your users for you, plus SDKs for Java, Node, Python, PHP and .NET that made the whole thing roughly ten lines in your own code. Hazlewood came to this with real credibility: he had chaired the Apache Shiro project, which is the Java security framework a lot of those same developers were already using. The homepage said "Never Build Auth Again" and for the sort of team that reads a homepage looking for a lie, that one checked out.

The money followed. A $1.5 million seed from Flybridge in 2012, an $8.2 million Series A in February 2013 led by NEA and Pelion, then $15 million more in September 2015. By then the field they had helped invent was crowded, with Auth0 raising hard and Amazon shipping Cognito, and identity was moving from a developer tool to an enterprise purchase.

~ the case file ~

~ why developers trusted it ~

The documentation is the part people still bring up. Stormpath wrote long, careful, working guides for every stack it supported, and they were good enough that developers read them to learn how authentication should work in general rather than only how to call this particular API. The blog did the same job. If you searched for how to do token based auth in Express in 2016, a Stormpath engineer had already written the answer.

I have spent most of my working life on the other side of this trade, where the hard problems are on the device and auth is a checkbox that has to not be embarrassing. Buying that checkbox from a company whose entire existence depended on getting it right was an easy argument to make to a team lead, and the risk that argument never covers is the vendor getting a good offer. Okta's offer arrived in March 2017.

~ the five and a half months ~

Okta announced on 6 March 2017 that it had acquired Stormpath. About thirty-five people went across, Salazar and Hazlewood included, and the deal was openly about the team and a license to the intellectual property. Okta did not want the customers.

Those customers got a migration FAQ and a date: 17 August 2017. The FAQ was honest enough to admit that the new Okta SDKs might not ship before then, which left people choosing between waiting on a tool that did not exist and moving to Auth0, which spent that spring publishing migration guides aimed directly at Stormpath's install base.

~ the next chapter ~

The domain served a goodbye page for years afterward: "Stormpath has joined forces with Okta. The Stormpath API shut down on August 17, 2017. Thank you to all the developers who have used Stormpath. Keep building amazing things." By 2023 it was a bare 404, and today it answers "Site Not Configured".

Some of the code outlived the company. JJWT, the Java JSON Web Token library Hazlewood wrote and Stormpath sponsored, is still a default dependency in Java projects that have never heard the company name. The rest of the bequest is less flattering to the industry that received it. A generation of startups learned that the service holding your user accounts can be bought away from you with twenty-four weeks of notice.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »