- /login by email & password
- /register by email & password
- /passwords/forgot
- /passwords/reset
- /oauth/fb
2FA, if user logs in with a new device with a new device ids OR new IP we need to send them a otp via email to validate.
Consider using Kong for authentication layer. We don't write our own crypto, so why should we write our own auth?
In Kong, A consumer can have many credentials.
For username+password auth, we can use:
https://getkong.org/plugins/basic-authentication/
, can provision new credentials too.For facebook/google auth, we can use
https://getkong.org/plugins/jwt/