For a startup and smaller orgs whose real goal is to survive, yes you are right resources are scarce and they shouldn't invest their time and effort on that fro

For a startup and smaller orgs whose real goal is to survive, yes you are right resources are scarce and they shouldn't invest their time and effort on that front. But I think beyond that it is, if you go to larger orgs, if you have engineers who can't write services/client implementations like this. Then you have made bad hires. Don't get me wrong, it is my opinion that you need more defensibility in the product. I do not think it is re-inventing the wheel, you are abstracting the wheel for me, because now I have to implement your client. If you take a step back and objectively look at it, your product is service-of-a-service, which I think is a problematic approach. On your comparison with Auth0, it is very naive to generalise that argument. You have to look at them in isolation. At the time, when Auth0 came into existance, state of security was bad. In general, multi-factor authentication, machine-to-machine authentication, implementing oauth/oauth2 correctly was a really big pain in the industry. I can actually bet you that only a handful of engineer even today can do it right and cost of doing it wrong is much higher.