Customer Identity & Access Management (CIAM)
Designed and built a centralised CIAM platform from the ground up — replacing fragmented, outdated authorization logic with a single, modern auth layer that the entire product could depend on.
Problem
FrankieOne's authorization was spread across multiple services with no single source of truth. The existing implementation was built on aging technology, making it difficult to extend, audit, or scale — and increasingly risky as compliance requirements grew.
Solution
A centralised CIAM service purpose-built for extensibility. Built on Better Auth with a Fastify/Node.js backend and PostgreSQL, it owns authentication, MFA, SSO, JWT lifecycle, and role-based access control under one roof. Infrastructure was provisioned via Terraform and deployed through a CI/CD pipeline on EC2, with Prisma managing the data layer.
Impact
- Hardened security posture with consistent, auditable auth across the product
- Modernised the auth stack, reducing complexity and technical debt
- Unlocked the ability to extend with new login mechanisms (SSO, passkeys, etc.) without touching core services
- Successfully migrated existing customers to the new platform with no disruption
My Role
- Provisioned infrastructure — database, EC2 service, and full CI/CD pipeline — from scratch using Terraform and GitHub Actions
- Scaffolded the project and built the API layer on top of Better Auth
- Integrated the new CIAM service with existing frontend and BFF layers
- Led the migration of existing customers to the new platform