Build vs Buy: The Real Cost of Rolling Your Own Auth

Building authentication is genuinely easy, which is exactly the trap. A form, a hash, a session — an afternoon’s work, and it functions. The estimate is not wrong about the login screen. It is wrong about the two years that follow it.

What the estimate leaves out

• Password recovery, email verification, and every edge case in both.
• Rate limiting, lockout policy, and the support process for people locked out.
• OAuth providers — each with its own quirks, and each breaking on its own schedule.
• MFA, recovery codes, and lost-device support.
• Audit logs, because a customer will ask and "we don’t keep those" ends the conversation.
• Session revocation, token rotation, and the incident where you need both at 2am.
• A security review you cannot answer with "we wrote it ourselves".

When building is still right

If authentication is your product, build it. If you have a regulatory constraint no vendor can meet, build it. If you are a hobby project and the learning is the point, build it. Those are real cases and this is not an argument that nobody should ever write auth code.

“The question is not whether your team can build authentication. It is whether the third year of maintaining it is the best available use of them.”

For everyone else the calculation is unsentimental. The free plan covers a side project; a paid plan costs less per month than an afternoon of engineering time, and the list above stops being yours.

See what it costs →