Don't listen to anyone saying "Don't write your own X". These things are not that hard once you filter out all the useless abstractions added by various libraries trying to give you a turn key solution. I suppose many just feel safe leaving responsibility in someone else's hands. I have never looked back after fighting passport.js some 10 years ago - being completely free to make you auth flow exactly how you need it is liberating! Now once you've done that a few times you are also in a much better position to decide if it might actually make sense to use a library or some auth provider for any future solutions.