- /login by email & password
- /register by email & password
- /passwords/forgot
- /passwords/reset
- /oauth/fb
2FA, if user logs in with a new device with a new device ids OR new IP we need to send them a otp via email to validate.
Consider using Kong for authentication layer. We don't write our own crypto, so why should we write our own auth?
AWS API Gateway's authentication schemes are limited to AWS credentials. Tokens and oauth can only be forwarded to the backend for the services themselves to handle...