Please don’t roll your own Auth - there are too many examples where this went wrong.

Go with a proven, vetted, and trusted open source solution.