I always understood the "dont write your own auth" as a much more low-level understanding of "auth", such as not writing your own password hashing (use bcrypt),

I always understood the "dont write your own auth" as a much more low-level understanding of "auth", such as not writing your own password hashing (use bcrypt), not reinventing the wheel (dont design your own cookies / sessions, use a library, or do it like a library does it). Ive never understood it as "dont make an api call to some auth yourself", because really, theres no problem with that (in my mind).