Your API shouldn't own its users
Every API ends up rebuilding user tables, password hashing, lockout and GDPR erasure. Nod is a self-hosted auth backend your APIs call instead. Here is what it is, and the decisions behind it.
nodauthenticationsecuritygdprself-hostedapi-design