Speaking from experience, what’s actually tricky about building your own auth isn’t the core functionality - there are lots of examples online - but rather all the things around authentication and user management that people don’t consider at first, but eventually become necessary when you go to production:
- password reset flows
- validating & cleaning inputs
- supporting multiple SSO methods for same account
- disconnecting or switching SSO methods
- handling duplicate accounts
- handling users who lose access to their login method
- email verification
- session cache validation
- detecting risky logins
- 2FA
- the list goes on…