Built a secure auth system featuring JWT with refresh token rotation, Redis-backed session management, and TOTP-based 2FA. Designed with security-first principles for production-ready deployment.