Business - SSO via Oauth2, with Azure AD as a ready to use integration
Developers - SSO via Oauth2, with prepared integrations for Github, Gitlab, Keycloak, Okta, or Google.
Personal banking or services where a tie to your real identity is an absolute must - SSO through your national id provider.
Personal sites with less stringent security - SSO with Google or Apple. Here you may also roll your own identity with user+pass+2fa. I guess this is the category you are interested in based on your suggestion. This is also the category with most variety in the field, for example some sites allow email login and recently passcodes are getting popular here.
Building auth stacks is not trivial and is not what will make your SaaS successful. The more you can leverage experts to focus on what makes your SaaS special, the better.
As a suggestion for what to implement (I'm biased because I work there) but I'd encourage you to check out Stytch (https://stytch.com). We're an API-first authentication, authorization and fraud prevention B2C and B2B solution with several methods including email/password, email magic links, social logins and 2FA (OTP, TOTP).
For average usage, mobile based auth is ok - although in that case you are relying on the security infrastructure of telecom operator, which in many country is not that good - e.g. identity theft to hijack someone mobile number is quite common.
From just the headline I thought the question was slightly different however: JWT with requires time, UA, IP and some decay of variance of these customisable via an integer value from 0 to 100. Let the user choose?
LOL.
No device fingerprinting via JS or any 3rd party as I believe in users' liberty.
So, how the user gets the above JWT:
Is any authentication needed?
Is they want to opt in, how's a trip code?
An account name recoverable via email. Or secret. Or SMS. Or remembering last account action? Or a combination?
For a sensitive action, what's the tradeoff between verification and convenience? Against what sort of actor?
SMS is exclusionary. Which works if you want to exclude non US/EU phone dependent users and target those that care little about security or privacy.
My firm doesn’t offer SMS to clients unless they explicitly ask for it now.
