Not that difficult, except that you need: * sign up / sign in routes. * reset password flow * multifactor enrollment and validation * email verification and

Not that difficult, except that you need: * sign up / sign in routes. * reset password flow * multifactor enrollment and validation * email verification and email templates * rate limits to prevent brute force attacks There is a reason entire companies exist to solve this. Properly implementing your own login creates a lot of wasted development time, especially when OAUTH2 is an industry standard.