https://almeidazs.com/en-us/blog Notes on what I build: architecture, decisions and what went wrong along the way. en-US https://almeidazs.com/en-us/blog/conta-rockfeller-sso https://almeidazs.com/en-us/blog/conta-rockfeller-sso Thu, 22 Oct 2026 12:00:00 GMT An in-house OpenID Connect provider built on Better Auth, with per-school roles, global logout, outbox-backed webhooks and authorization for AI agents. The decisions, the mistakes and what I'd do again. sso oidc oauth better-auth nestjs security architecture