The build-vs-buy trap: identity is bigger than it looks.

Login is the visible 10 percent of identity. The other 90 percent is the unhappy paths: password reset that survives edge cases, token revocation that propagates fast, session management across devices, social-provider quirks, and account recovery for a user who has lost email, phone, and their device at once. Each of these looks small and each is a project.

The trap is that the estimate is made once, optimistically, at the start. Engineering scopes "add login" as a two-week feature, ships the happy path, and then spends the next two years paying down the difference. By the time the team arrives at a CIAM vendor, the homegrown system is not a clean starting point; it is years of accreted logic and half-finished flows that now have to be migrated. That makes the migration workstream worse, not better.

The mature framing is to estimate honestly and early. Cost the unhappy paths, the compliance automation, the peak-load behavior, and the ongoing security surface, then compare that to buying. For most teams the answer is buy, and the signal that build was the wrong call is usually the quarter the auth backlog stops shrinking. See build vs buy and the key concepts buyers actually check.