The boundaries are between logical components of your application in your business domain. The two you identified (auth and payments) are a good fit, especially because they also rely on external services a lot.

The other heuristic to follow is how your company is organized. If you have a separate team working on a major feature then perhaps that could be its own service so they can own the full-stack.

Otherwise, stick to the monolith for the best results.