Authentication looks simple until you ship it across several products, several domains, and more than one way to sign in.
We put login in one place: an identity service that authenticates the user once and issues tokens other apps can trust. Browser apps use Authorization Code + PKCE. We also have SSO and Google/Facebook on the identity server, not in each SPA.
This is how we actually built it, and why those choices stuck.
1. One identity service, many apps
If every product kept its own login, people would juggle passwords, you’d store secrets in more than one place, and hopping between apps would mean signing in again and again.
