> I think today it would not be unreasonable to take a "microservice" kind of approach where auth is handled by some self-contained system through an API but pr

> I think today it would not be unreasonable to take a "microservice" kind of approach where auth is handled by some self-contained system through an API but practically you might want to be able to join stuff against your user table. One option for writing less code yourself might be using something like Auth0 (cloud) or Keycloak (self-hosted) with some OpenID Connect library for your tech stack, or a Relying Party implementation altogether, like: https://github.com/OpenIDC/mod_auth_openidc https://github.com/OpenIDC/mod_auth_openidc They'll get you most of the way there, without making you write a bunch of security related code yourself (which is also more likely to cause issues, if someone isn't familiar with the domain).