Harker, as a platform, deals with sensitive information about vulnerable people. That’s why security is, and always will be, one of our top priorities. A big part of that is making sure the right people can access Harker.

Until recently, we relied on a piece of software called Kratos to handle our authentication. From logging in and creating an account, to resetting a forgotten password, Kratos sat behind many of the ways people accessed Harker.

Kratos worked well, but as Harker has grown, so have our needs. We wanted more control over how authentication works, a simpler system to maintain, and a better foundation for features we might want to introduce in the future. So, we decided to replace it.

We settled on using Better Auth: a modern authentication framework that could become part of Harker itself, rather than being a separate service running alongside it. On the surface, swapping one authentication system for another sounds fairly straightforward. As we quickly discovered, it isn’t quite that simple.

The importance of user authentication in charity CRMs

User authentication is responsible for a lot more than simply checking a password. In Harker, it sits at the boundary between users and the sensitive information they have access to.

Harker needs to know not only that your email and password are correct, but things such as who you are, which charity and service you belong to, what you’re allowed to access, and whether you should be signed in at all. Once you’re in, Harker needs to keep track of your session, recognise you as you move around the platform, make sure you can only access what you’re supposed to, and know when that access should end. All of this has to happen quietly in the background while people are using the app.

So replacing Kratos became less about building a new login system, and more about carefully untangling Kratos from the rest of Harker. We had to track down every single bit of code where the app relied on it and replace those connections one by one, all to keep Harker working the same way we know and love it.

Maintaining consistent user accounts and records for charities

Building an authentication system in itself is one task. Building a new one for an app with existing accounts, passwords and identities spread throughout the platform is another. This naturally added to the complexity of the problem.

We could have taken the easy route and had everyone set up their account again. However, that would have meant creating hassle for every single Harker user simply to temporarily make our own lives, as devs, a little bit easier. Obviously we, thinking of our valued customers, didn’t really want this. Instead, we set ourselves the challenge of moving existing accounts over with as little disruption as possible. That meant preserving the things that make each account what it is: its identity, credentials, organisation and connections to the rest of Harker.

Fortunately, Better Auth is flexible enough to make this possible. We’ve been able to design the new system around the accounts Harker already has, rather than forcing those accounts to fit around a completely new system. Existing identities can be preserved, passwords can be moved across securely, and the rest of Harker can continue to recognise each user just as it does today.

The benefits of strong user authentication for charities and their frontline workers

Bringing authentication closer to Harker gives us so much more control over how people access and manage their accounts, while simplifying what we have to maintain behind the scenes.

That opens the door to many enriching features such as passkeys, MFA (Multi-Factor Authentication), SSO (Single Sign-On) and general improved account management in the future. SSO, for example, will be massive, since it will allow users to log in to Harker using their organisation’s centralised system (e.g. Microsoft 365, Google), greatly reducing security risks such as login credentials falling into the wrong hands. More importantly, we can introduce such features on our own terms, based on what actually works for the people and organisations using Harker.

Ultimately, the best authentication system is one you rarely have to think about. It should simply keep your account and data secure, and let you get on with what you came to Harker to do. Better Auth gives us a simpler, more flexible foundation that can grow alongside Harker for years to come.