You could use something like Django as an API for React to hit. It has user auth, and if you use django-rest-framework it works flawlessly with React/webpack

Are you open to using parse-server? It has good auth API's built in.