[jtsiskin]

To me the exact opposite - it’s seems like a prime candidate to be a third party service.

It’s something easy to get wrong, and has a long tail of work which is extremely generic (supporting all the different social logins, two factor authentication, password reset emails, email verification, sms phone number verification, rate limiting, etc...)