How can we guarantee our custom auth implementation to a client?

Question

Context
In .Net 4.6 my team used Microsoft's built in authentication/authorization systems primarily through its Owin tools. In .Net Core Microsoft decided NOT to port that segment of tools. So, we made the decision to write our own auth middleware to generate, authenticate, and authorize JWTs in our .Net Core apps.

Note: We were careful to ensure we followed OAuth standard very closely

The Question
Is there any 'stamp of approval' for our custom auth middleware we could have to assure client's our application security is trustworthy?

The Scenario
The idea is that a client could come to us and say 'what kind of security are you using on our app?' We would explain the security pipeline used in there app and include our custom auth in that response. Then they could likely respond 'Custom auth middleware? That sounds dangerous, how can you assure us its secure?'

The Posibilities
What were searching for might be a certificate, it might be just to say that our auth system follows a particular standard. Or maybe, there is nothing at all and the best we can do is just say 'trust us, weve done this before... -_-'.

Answer 1

If you have the money get a pen test of the system from a reputable firm. Lots of firms are available (e.g. Synopsys/Cigital, Rapid7, SEC Consult, etc.). Expect it to cost you $40K to $50K USD.

Then you can either show the test report to your customer or you can tell them that you had it pen tested it no issues were found. Be careful about showing reports to customer, if you do it once they'll expect it from then on. My company will not show pen test reports to a customer, but will characterize them (e.g. "X highs were found, Y mediums, and Z lows and all have been remediated").