Not that difficult, except that you need:

* sign up / sign in routes.

* reset password flow

* multifactor enrollment and validation

* email verification and email templates

* rate limits to prevent brute force attacks

There is a reason entire companies exist to solve this. Properly implementing your own login creates a lot of wasted development time, especially when OAUTH2 is an industry standard.