It's common to have two user ids. An anonymous_id stored in a cookie or localStorage a user_id from your auth system. Every visitor would have an anonymous_id attribute, but only logged-in users would have a user_id attribute.
When creating an experiment rule for a feature, you specify which attribute you want to use to split traffic. So if the experiment is before the auth flow, you would choose
anonymous_id
, otherwise
user_id
.