Use OAuth 2.0 for delegated authorization and API access. Use OpenID Connect (OIDC) for identity verification on top of OAuth. Use established, well-audited libraries for JWT generation and validation — not hand-rolled implementations.

Audit every authentication pathway your API exposes: mobile app login, web login, SSO, social auth, API key flows, deep links. They all need to be secure.

Authentication is one of the hardest things to get right in security. The failure modes are subtle — JWT algorithm confusion, timing attacks on password comparison, OAuth redirect validation. Published standards have been reviewed by thousands of security researchers for years.

Custom auth has been reviewed by the three people who built it.

Using OAuth doesn't automatically mean you've configured it correctly. Misconfigured OAuth flows (open redirect validators, unvalidated state parameters) are themselves a source of broken authentication. Using the standard is necessary but not sufficient — you still need to implement it correctly.