I built a small on-call tracker for my team in a few hours. The tracker itself was easy, but figuring out how to let exactly six people use it—and keep everyone else out—took much longer. I eventually put a shared password in our team chat, which works but feels insecure and difficult to manage. Building a complete login system for six users also seems excessive. How would you handle authentication and authorization for a small internal tool like this?
4 Answers
The right level of security depends on the data and deployment. A low-risk tracker behind a company VPN might only need network access plus a basic identity check, while anything containing sensitive or regulated information needs proper authentication and authorization. Also check whether your company has rules against deploying unofficial tools outside approved infrastructure.
For an internal tool, I’d put an authentication proxy in front of it and connect that proxy to whatever identity system your infrastructure already uses. You can start with a simple allow-list or group check and add more detailed roles later. This keeps authentication out of the application and avoids building a whole user-management system.
If there’s no company identity provider and the tool really needs individual accounts, use a standard password-hashing library such as Argon2id, scrypt, bcrypt, or PBKDF2, and keep the allowed-user list small. Another lightweight option is passwordless email links: accept an email address, send a short-lived one-time login link, and only send links to the six approved addresses. That gives you individual access without designing a full login workflow.
If your organization already has a central identity provider—such as Microsoft Entra, Okta, or another OIDC/SAML service—use that instead of creating accounts yourself. Let the provider handle sign-in, then allow access only to a specific group. You get centralized account removal, auditability, and no passwords stored in the app.
If you do keep a shared password temporarily, store it in an approved password manager rather than leaving it in team chat. It still won’t provide individual accountability, but at least it can be rotated and access can be removed more safely.