Current Usage
Currently used by:
- IdeaHub
- Resource Hub
- Vaultex
Supports:
- Google Login
- Email & Password Authentication
Why I Built It
Instead of copying authentication code into every project I built, I wanted a centralized authentication service that could be integrated across multiple personal products.
At that time, I wasn't aware of services like Clerk, BetterAuth, etc., so I decided to build one myself.
Technical Decisions
1. Asymmetric JWT Authentication
While building the service, I learned about asymmetric cryptography and implemented it.
Why?
This allows applications to verify JWT tokens without sharing the private signing key.
Benefit
I don't need to share the secret used for signing tokens across all my personal products.
2. Local Token Verification
I decided to expose a token verification route that applications could use to establish their own sessions.
Applications verify tokens locally instead of calling Auth Service on every request.
Why?
If every request from every application hits Auth Service, Auth Service becomes a bottleneck and can crash under load.
3. Timing Attack Protection
While building login functionality, I learned about timing attacks.
Problem
Attackers can sometimes identify whether a user exists by measuring login response times.
Solution
When a user does not exist, I still perform bcrypt comparison using a dummy hash.
Benefit
Response times remain more consistent.
4. Async Email Workflow
Built an asynchronous email processing pipeline using:
SNS → SQS → Lambda
Additional Components:
- Dead Letter Queue
- CloudWatch Alarms
Purpose
Send transactional emails in the background.
Challenges & Lessons Learned
Email Workflow Failure
After a few months, the async workflow silently stopped working.
I stopped receiving emails.
Initial Situation
I couldn't understand why the workflow was failing.
Root Cause
The Gmail App Password used by Nodemailer had expired.
Resolution
Migrated email delivery to Resend.
Lesson
Infrastructure dependencies fail silently if not monitored properly.
Over-Engineering
I realized I had over-engineered the email delivery architecture for my scale.
At that time:
Users on platform = 0
Yet I had:
SNS SQS Lambda DLQ CloudWatch
Realization
The architecture was unnecessary for my scale.
However, it gave me exposure to AWS services and large-scale email architectures.
Cookie Session Debugging
Spent nearly a week debugging cookie-based session persistence.
What Happened
User sessions were not surviving page refreshes.
I experimented with different cookie configurations until the issue was resolved.
Outcome
Developed a deep understanding of:
- Cookie attributes.
- Session persistence.
- Browser behavior.
Impact
Auth Service is actively used by IdeaHub, Resource Hub, and Vaultex, providing centralized authentication across personal products.
Future Vision
1. Access & Refresh Token Architecture
Implement proper session renewal mechanism.
2. Email Verification
Implement user verification flow.
Evolved
Public Key Endpoint for Local JWT Verification
I exposed an endpoint that returns the public key in the response, so consumer backend services can verify JWT tokens locally without storing the public key in their environment variables.
This removes the dependency on shared secrets or manually copied keys across personal products.
MongoDB → PostgreSQL Migration
I migrated the database from MongoDB to PostgreSQL as a step toward introducing access and refresh tokens instead of a single long-lived token.
Due to time constraints, the access/refresh token implementation is still planned — see Future Vision above for the original intent.
Technologies Used
Last updated August 10, 2026
Related Projects
IdeaHub
Centralized platform for capturing product ideas and thoughts, with soft delete and Auth Service integration.
Resource Hub
Centralized resource platform with presigned MinIO uploads, webhook-driven documents, PostgreSQL + Drizzle, collections, and Auth Service integration.
Vaultex
Full-stack transaction app with idempotency-aware mutex locking, TOCTOU concurrency debugging, interactive labs, and Auth Service integration.