A team proposes building an authentication service rather than buying one, arguing it is two weeks of work. Respond.
Show the full answer Hide the answer
What the interviewer is testing
Whether you can price the full lifetime cost of building, and whether you apply the differentiation test.
The response
They are probably right that a basic version is two weeks. That is not the cost.
What follows the two weeks, indefinitely:
Password reset flows, email verification, account lockout and rate limiting. Multi-factor authentication — TOTP, SMS, push, then passkeys. Social and enterprise federation, SAML and OIDC as customers demand them. Session management, token revocation, device management. Suspicious login detection, credential stuffing defence, breached-password checking. Account recovery, which is the hardest part of identity and the most common route to account takeover. Audit logging, compliance evidence, and penetration testing.
Plus the security obligation: this is the highest-value target in the estate, and a defect here is a full compromise. Keeping current with attack techniques is a continuing commitment, not a project.
The differentiation test
Build what differentiates, buy what does not. No customer chooses your product because of your login page. Identity is undifferentiated infrastructure, and it is one of the clearest buy decisions available.
The engineering argument that it could be built in a fortnight is true and beside the point — the fortnight is not the cost.
The legitimate concerns to address
Lock-in: mitigated by standard protocols and by keeping the user identifier mapping in your own data, so migration is possible.
Cost at scale, which can be significant for large user bases — worth modelling against the fully loaded build cost including the ongoing maintenance and the security obligation.
Specific requirements the product does not support, which should be checked concretely rather than assumed.
What a strong answer adds
The middle path when a genuine gap exists: buy the identity provider and build the thin layer that handles your specific authorisation model on top. That is a much smaller and more defensible build than authentication itself.
Common weak answers
Refusing on principle without pricing it. Approving on the two-week estimate.