Authentication API

Situation before deployment

The four business SaaS products we offer each had their own authentication implementation. The code copied when the first service launched was inherited by later services, so the fine-grained behavior of authentication differed subtly across products.

Existing customers were increasingly requesting MFA support and immediate token revocation for departing employees. Adding a feature to one service required rolling out the same change to the other three, which was straining development resources.

Authentication is a shared component affecting every service, so an outage would take down all products at once. Adding redundancy and audit logging also meant hand-fixing four implementations individually, and a fundamental redesign was needed.

Background and selection reasons

Three options were considered: adopting an authentication SaaS, building an authentication platform in-house from scratch, and building on top of NocodilySuite's authentication API. The authentication SaaS charged per user, making running costs hard to predict at the scale of 500+ customer companies. Fully in-house build could meet the requirements but risked stretching the development timeline.

We chose NocodilySuite because token issuance, revocation, MFA, and audit logging were provided out of the box, making it easy to embed as the authentication layer for our services. The endpoint-level composition, allowing us to replace only the pieces we needed in stages, was highly rated.

In the PoC we switched login and token refresh flows for one existing service and verified behavior. After confirming that uptime and response time matched the existing implementation, we moved forward with rollout to other services.

Deployment process

The overall project ran for three months. Month one covered PoC and authentication flow organization, month two integrated token issuance, revocation, and MFA endpoints, and month three rolled out to all four services in stages. Since the existing login UI was preserved and only the API side was swapped, no user-side learning cost was incurred.

MFA was made optional for existing accounts. It is mandatory for admin accounts and recommended for general users, with a guidance screen shown on first login. The token revocation API integrates with our HR offboarding system so that at contract end, users are logged out of all services simultaneously.

Authentication audit logs are all recorded at the platform layer. Previously each service emitted its own logs, requiring aggregation during audit response, but centralizing them at the platform level simplified that work.

Changes after deployment

The authentication platform maintains 99.99% uptime, and there have been zero authentication-caused service outages since deployment. Average token issuance response is 82ms, more stable than the in-house implementation.

MFA activation reached 78%. All admin accounts are enrolled, and general users have opted in as well. Authentication-related change requests dropped to a few per month, freeing development effort for business features.

Centralizing authentication logs greatly reduced audit response time. Previously we had to cross-reference logs from four services, but now the platform lets us query them together, so we can respond to audit requests by the next business day.

Future Plans

In the next stage we plan federation with external IdPs and passkey support. We will keep adding functionality as an authentication foundation while avoiding increased modification cost on existing services, rolling out changes incrementally.