you could use Auth0 [1] to authenticate your clients using all the identity providers (FB/GOOGLE...etc) and then just have the api clients use that JWT token when talking to postgrest

If however you do only want to authenticate the users yourself, the login function can be very simple [2]

1. http://postgrest.org/en/v6.0/auth.html#jwt-from-auth0

2. https://github.com/subzerocloud/postgrest-starter-kit/blob/m...

I am using postgraphile in library mode with keycloak and passport.js (an open source project https://www.keycloak.org/) instead of auth0 and it works great.

I would expect authorization and validation to be a real pain with PostgREST (I don't know enough about it to tell definitively, though).

Even row-level access control, while not widespread any way, is often not enough. Complex validation in SQL can be done, of course, but SQL isn't exactly meant for these things, IMHO.

This is an interesting read on validation in postgres: https://begriffs.com/posts/2017-10-21-sql-domain-integrity.h...

Stored procedures often offer a better and more efficient way to implement data validation than non database native alternatives.

It may indeed be efficient.

Maybe I just don't like the idea of putting all my application logic into SQL statements.

What I like about Django's ORM, for example, that you can declare a field to be an IP address, and this not only does the validation (which SQL can do easily, I am sure), but this declaration also carries over to HTML forms, admin interface, REST API serialization and HTML Templates.

why would you "expect" that if you don't know about it?

I know more than basic SQL. Maybe I am indeed not an accomplished enough master in SQL, but I can't see why I would ever prefer SQL over Python in terms of defining application logic.