It is relatively trivial to integrate Twilio and email for 2FA/OTP and/or password resets etc. That's my personal method. I also use the jsonwebtoken package

It is relatively trivial to integrate Twilio and email for 2FA/OTP and/or password resets etc. That's my personal method. I also use the jsonwebtoken package and passport-jwt typically for the JWT which keeps that all pretty clean and means I don't have to mess with doing any of the header parsing etc (not that it is that much work). If you exclude the database access/update code from the auth portion of the setup and use passport with the supporting packages, you'll write probably on the order of less than ~200 lines of JS to handle all the standard auth type things (just did a rough count on one project I have). That included in my case using twilio to send 2fa and OTP codes via SMS (sends via email too but that uses a different library I wrote). The choice of database and specific schema of course isn't factored in to those figures. For mongodb, it typically only adds an additional ~200 lines, but for postgres (no ORM tooling) it'll be more like 300-600 lines. But you will need to write this code no matter what if you want to maintain a user table, even if you use a third party, you'd just have a federated key instead of a username/password combo. So in the end, I would say for < 300 lines of proper code (excluding db crud) you have the basic structure setup and working. BTW -- I am excluding from my LOC counts above my middleware I wrote for things like logging, metrics, etc. But even including them wouldn't make it change by much.