I'm not afraid, I just don't understand the nuances well enough. But it's also easy to understand what there is to be scared about: 1. Security critical. 2.

I'm not afraid, I just don't understand the nuances well enough. But it's also easy to understand what there is to be scared about: 1. Security critical. 2. Single source of failure. ( If your auth fails, it doesn't just break one feature or aspect, it takes everything and everyone down with it. ) 3. Performance critical. It's a bottleneck in most applications, it's very rare and even more difficult to get distributed auth working, if you factor in repudiation / token cancellation. It's not an area you can "fake it 'til you make it" or "move fast and break things" with. Even just "buying" the solution isn't easy. Actually implementing your own OIDC client/server solution is a large project that only makes sense to dedicate a team to in the largest of organisations.