Auth That Users Trust
Email, OTP, Google OAuth, and JWT middleware — security without friction theater.
Finance apps live or die on auth trust. Users will not type salary details into something that feels sketchy at login.
BolKharcha supports email/password, phone OTP, and Google OAuth so people can enter through the door they already trust.
JWT-protected APIs with middleware keep authorization consistent. Do not sprinkle ad-hoc token checks across handlers.
Password reset via email is not glamorous. It is mandatory. Document the flow. Test the ugly cases.
Session UX matters: clear logged-in state, obvious logout, and calm error messages when tokens expire.
Never confuse security theater with security. Long password rules without breach hygiene help no one.
Good auth is invisible when it works and crystal clear when it fails.