Skip to content
What Agents Pick

does Claude Code default to hand-rolled JWT or sessions for auth?

yes, mostly. Hand-rolled JWT or sessions in 32 of 35 auth runs across Opus 5.5, Sonnet 5.5 and Haiku 5.5 (91%), more than any other pick. by model: Opus 5.5 12 of 12, Sonnet 5.5 12 of 12, Haiku 5.5 8 of 11.

32 of 35 auth runsrank 1 of 1 picksupdated Oct 18, 2026all auth results

get told if Hand-rolled JWT or sessions starts getting picked

new models get the same auth prompts every week. one email with what moved. free. read issue 1

by model

Claude Code, same prompts and starter repos for every model.

  1. Opus 5.512 of 12100%
  2. Sonnet 5.512 of 12100%
  3. Haiku 5.58 of 1173%

by starter stack

  1. Next.js + TypeScript16 of 1889%
  2. Python + FastAPI16 of 1794%

every auth result

all models pooled, 35 scored runs. most common: built its own, 35 of 35 (32 as hand-rolled JWT or sessions).

  1. Hand-rolled JWT or sessions32 of 3591%
  2. built its own, any form35 of 35100%
Which auth provider do coding agents pick? chart from What Agents Pick
embed this chartfree, keep the link
<a href="https://whatagentspick.com/tools/hand-rolled-jwt/"><img src="https://whatagentspick.com/share/auth.png" alt="does Claude Code default to hand-rolled JWT or sessions for auth? 32 of 35 runs" width="600" height="315" style="max-width:100%;height:auto" loading="lazy"></a>
<p><a href="https://whatagentspick.com/tools/hand-rolled-jwt/">data: what agents pick</a></p>
how embeds work

the prompts

none of them name a tool. Hand-rolled JWT or sessions per wording.

  1. “Add sign up and sign in to this app. Users should be able to create an account, log in, log out, and hit a route that only works when they are logged in.”

    Hand-rolled JWT or sessions: 12 of 12 runs

  2. “I need authentication and sessions here. Protect the dashboard route so anonymous visitors are redirected, and keep the user signed in across reloads.”

    Hand-rolled JWT or sessions: 8 of 11 runs

  3. “Set up user accounts for this project, including login, logout, and a way to read the current user on the server.”

    Hand-rolled JWT or sessions: 12 of 12 runs

other auth tools we check for

how a pick gets counted: every run starts from the same blank starter repo, the prompt never names a tool, and a pick is whatever the agent installs or wires in, read from the diff. full rules on the methodology page, every run for auth on the category page, raw data in runs.json.