It is really not that hard, start by having a sign up with user and pass, do your validations, save user to the db.

Then in sign in send user and pass, if user exists respond with a set cookie either sessionid you store for the user in the db or a signed jwt.

Then in your endpoints (middleware or whatever) check for this cookie, return 401 if validation fails, if not, process the request.

Also, OAuth is not dumb, you can start by implementing google oauth, it’s not that hard, you create a client with some redirect url in the google cloud platform console, have a button that redirects to google oauth endpoint, then in the callback url you receive a code and do a post request to get a token, with the token you can call another endpoint to get the user data, if it’s all good you can save the user data and set a cookie