Simas ID

Every product was integrating sign-on from scratch.

Each product team wired its own OAuth flow, which meant the same bugs found four times and four slightly different consent screens. Nobody could say with confidence how long sign-in took, or where people were dropping out of it.

The brief: one flow, one library, and enough instrumentation to argue from numbers.

One library, adopted rather than mandated.

• A
  A shared auth package

  Bundled with tsup and versioned, so integrating teams got the flow, the token handling and the types in one install instead of a copied folder.

• B
  OAuth 2.0 with PKCE

  NextAuth.js drives the exchange; refresh and revocation live in the library, not in each product's route handlers.

• C
  Instrumented from day one

  Datadog RUM and logging for LCP, error counts, frustration signals and time on step; Amplitude and GTM for the funnel itself.

• D
  Tested where it hurts

  React Testing Library and Jest around the flow's branches — expired tokens, denied consent, the back button mid-redirect.