“Custom auth isn’t craftsmanship - it’s calendar sabotage.”
We’ve been told that rebuilding authentication “one last time” keeps our stack clean and our control absolute. It doesn’t. It just trades momentum for maintenance. Side effects may include mysterious regressions at 2 a.m. and new appreciation for chamomile tea.
Here’s the pattern: teams burn 2–4 weeks wiring Devise + Pundit, password resets, roles, JWT, and sessions - before touching a single unique feature. Multiply that across retries and pivots, and you’ve got an entire quarter disguised as “setup.” Meanwhile, apps that start with a production foundation ship 3–5 weeks earlier and close the gap on polish while you’re still naming your “Users::SessionsController.” It scales faster than a crypto bro explaining Web3.
Why the belief persists
- Control feels safer than templates (until you inherit your own bugs).
- Past kits were half-baked: missing tests, flaky CI, no deployment path.
- Tailwind-first stacks added a UI learning curve some teams didn’t ask for.
But the market has shifted. Serious foundations exist that include the full stack: auth, roles, admin, REST API with JWT + Swagger, RSpec/Capybara, GitHub Actions, background jobs, and Mina/systemd/Nginx deployment - on current Rails (8.0.2) and Ruby (3.4.4 with YJIT). That means fewer seams, fewer unknowns, and fewer “we’ll fix it later” sticky notes.
The new perspective
- The bottleneck isn’t your login screen; it’s your indecision tax. Every “quick” rebuild delays feedback on your actual product.
- Security and stability are compounding games. Centralized patterns, tested generators, and CI/CD beat bespoke glue code.
- Familiar UI wins velocity. If Bootstrap is your team’s muscle memory, skipping utility-class soup keeps you shipping. Yes, you can still make it pretty. No, you don’t need a PhD in spacing utilities.
Vivid reality check
- Team A rebuilds auth: 3 weeks on Devise/Pundit/JWT, 1 week on admin, 1 week on deployment - feature work starts in Week 6.
- Team B starts on a production-ready Rails foundation: feature work by Day 3; first customer demo in Week 2; iteration beats invention.
Team B isn’t smarter - they’re just not dragging a boilerplate boulder uphill.
What this unlocks
- Ship core workflows first, on a base you can live with long-term.
- Keep tests, CI, and deployment boring (in the best way).
- Spend strategy calories on pricing, onboarding, and retention - not password reset edge cases. Your users don’t care that you hand-rolled bcrypt; they care that checkout works on a Tuesday.
The lightbulb
The question isn’t “Can we rebuild auth cleanly?” It’s “What would we build if auth were already done?” Momentum is a feature. Start where the product starts - on unique value - and let a trusted foundation handle the boring brilliance.
If you want that mix of reliability and speed without Tailwind lock-in, Rails Blueprint ships with the whole stack - Devise/Pundit, JWT + Swagger, RSpec/Capybara, CI, jobs, and Mina/systemd/Nginx - on Bootstrap. Familiar, pragmatic, and ready for production. Ok, your turn. I’ll be refreshing deploy logs like they’re Instagram.