Every user, off Auth0, in under three hours.
How a feature flag let a HealthTech platform switch identity providers without waiting for anyone to update.
- Company
- Kibu · HealthTech
- Role
- Senior Software Engineer
- Scope
- Auth0 → WorkOS · web + mobile + TV
- Window
- Under 3 hours
01The problem
At Kibu I led the move from Auth0 to WorkOS for a HIPAA- and SOC 2 Type II-compliant disability care product. Migrating the users is the easy half. The hard half is the clients: a web app, a mobile app and a TV app that each need to know where to sign in — and that don’t all update at the same moment.
An over-the-air update reaches people when their app picks it up, not when you press deploy. Anyone still on the previous build keeps talking to the old provider.
02Three clients, three strategies
Web, mobile and TV got different treatment, because they had different escape hatches.
| Client | How it moved | What decides the provider |
|---|---|---|
| Web · Next.js | Vercel release, promoted | Dual-provider setup reading the same PostHog flag |
| Mobile · OTA installed | OTA | The new build |
| Mobile · no OTA yet | Feature flag | Dual-provider setup reading a PostHog flag |
| TV | OTA only | The new build |
Web and mobile ran Auth0 and WorkOS side by side, with a PostHog feature flag choosing between them. Web was the easy one: a Next.js app, released by promoting the deployment on Vercel. TV went OTA only.
03The switch
The flag is the whole trick. Flip it and web moves over, and the mobile users who hadn’t downloaded the OTA are covered too — they sign in through WorkOS without updating anything.
Fig. 1 — Who signs in where
Web
Next.js · reads the flag · promoted on Vercel
Blocked
Mobile
OTA installed
Signs in
Mobile
No OTA yet · reads the flag
Blocked
TV
OTA only · no flag
Signs in
Flag off: web and anyone who hasn’t picked up the OTA are still pointed at Auth0.
2 / 4on WorkOS · 2 blocked
04The window
Migrating every user from Auth0 to WorkOS, cutting over web and shipping the OTA to the TV and mobile apps took under three hours, end to end. Nobody got blocked.
05What I’d keep
Put the switch somewhere you control. A flag you can flip beats an update you have to wait for — especially on devices you can’t reach on your own schedule.