If you have the budget for it just use auth0 or similar. You will likely spend less time wiring it up than coming up with a solution yourself. Going off your q

If you have the budget for it just use auth0 or similar. You will likely spend less time wiring it up than coming up with a solution yourself. Going off your question only, this will also likely end up being the most secure implementation for you (relying on a third party service)