Comment by Volundr

I'm curious whose telling you not to roll your own auth. I've worked on far more software that handles its own auth than integrates with Okta/Keycloak/Whatever.

In fact the general advice I've heard is "just use bcrypt"