Proof-of-concept login system into a reliable, well-tested platform
Role: Technical Lead
Client: Large travel organisation
Stack: React (frontend), Fastify (servers), Terraform (infrastructure), Auth0 (authentication)
Context
I was the technical lead on the authentication and profile management platform for a large travel organisation.
It started as a proof of concept, built to test whether people would sign up for an account if we gave them a sign-in button. It went live, and features kept getting piled on top of it. The technical debt grew with every one.
The Problem
| Region | Login time |
|---|---|
| Australia / New Zealand | ~5 seconds |
| Canada | ~8 seconds |
| South Africa | ~10 seconds |
When the platform was rolled out globally, three problems showed up.
Logins got slower the further you were from Australia. The app was only deployed in Australia, so distance became latency:
Changes took too long to ship. Our CI pipeline took an hour, so every fix and every new feature waited on it.
Bugs kept coming back. Test coverage was roughly 10%, and the tests we had checked how the code was written rather than what it did. Fixes didn't stick, and around 10 bugs a week were returning.
I tackled this in three steps. Each one is a decision, with what I chose and why.
Decision 1: Find the bottlenecks before rewriting anything
What I chose: I analysed the application for performance problems by drawing sequence diagrams for each flow: logins, social sign-ins, account creation and account updates. Then I looked for redundant requests and inefficient sequences of calls.
Why: I wanted evidence about where the time was going before committing to a bigger change. Mapping the flows was a cheap way to find quick wins.
Outcome: Login times improved by about 30%. That was a real gain, but it didn't touch the technical debt, so it showed us optimisation alone wouldn't be enough.
Decision 2: Rebuild the APIs into a simpler structure, with test coverage as the goal
What I chose: We rebuilt our APIs into a much simpler structure and made coverage of the backend an explicit goal.
Why: Returning bugs and a slow pipeline were symptoms of the same debt. A simpler backend with strong tests addresses both: fewer errors coming back, and faster turnaround for changes.
Outcome: After 6 months we were holding above 95% backend coverage. Bugs coming back dropped from about 10 a week to 1–2 every other week, and backend deployments went from an hour to 10 minutes.
Decision 3: Replace hand-rolled auth with Auth0
What I chose: We replaced our hand-rolled authentication and fully adopted Auth0's infrastructure, including its universal login form. We rebuilt how we built and distributed our JavaScript SDK bundle across the website, and used Terraform to manage our Auth0 configuration across all regions.
Why: Login was still limited by a system that lived in a single region, and we were maintaining authentication code ourselves. Moving to Auth0 and managing it as code let every region be configured consistently.
Outcome: Login times fell to 500ms.
What I did
Results
| Measure | Before | After |
|---|---|---|
| Login time | 5–10 seconds, depending on region | 500ms |
| Backend test coverage | ~10% | 95%+ |
| Bugs coming back | ~10 a week | 1–2 every other week |
| Backend deployment time | ~1 hour | ~10 minutes |
What I’d do differently
I'd change the order of the work. We added the new flows into the existing systems first, and only then rebuilt the APIs. Instead, I'd have connected the new APIs to the old ones to get the performance improvements, and moved over from there.
That would have got us onto the new systems faster.