auth-implementation-patterns – Coding skill for AI agents
Implement or review authentication and authorization with explicit token, session and resource-access boundaries.
Install the auth-implementation-patterns skill with one command
Pick the tool you use, copy the command and paste it in your terminal. The skill lands in that tool's skills folder and is ready in your next session.
Claude Code
mkdir -p ~/.claude/skills && curl -fsSL https://skill.dn1nguoi.com/z/auth-implementation-patterns-0c6de.tgz | tar xz -C ~/.claude/skills
Call it in Claude Code: /auth-implementation-patterns – then describe the task you want done.
Codex
mkdir -p ~/.codex/skills && curl -fsSL https://skill.dn1nguoi.com/z/auth-implementation-patterns-0c6de.tgz | tar xz -C ~/.codex/skills
Call it in Codex: $auth-implementation-patterns – then describe the task you want done.
Hermes Agent
mkdir -p ~/.hermes/skills && curl -fsSL https://skill.dn1nguoi.com/z/auth-implementation-patterns-0c6de.tgz | tar xz -C ~/.hermes/skills
Call it in Hermes Agent: /auth-implementation-patterns – then describe the task you want done.
DeepSeek
mkdir -p ~/.deepcode/skills && curl -fsSL https://skill.dn1nguoi.com/z/auth-implementation-patterns-0c6de.tgz | tar xz -C ~/.deepcode/skills
Call it in DeepSeek: /auth-implementation-patterns – then describe the task you want done.
SKILL.md content
Authentication & Authorization Implementation Patterns
Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.
Use this skill when
- Implementing user authentication systems
- Securing REST or GraphQL APIs
- Adding OAuth2/social login or SSO
- Designing session management or RBAC
- Debugging authentication or authorization issues
Do not use this skill when
- You only need UI copy or login page styling
- The task is infrastructure-only without identity concerns
- You cannot change auth policies or credential storage
Instructions
- Define users, tenants, flows, and threat model constraints.
- Choose auth strategy (session, JWT, OIDC) and token lifecycle.
- Design authorization model and policy enforcement points.
- Plan secrets storage, rotation, logging, and audit requirements.
- If detailed examples are required, open
resources/implementation-playbook.md.
Safety
- Never log secrets, tokens, or credentials.
- Enforce least privilege and secure storage for keys.
Resources
resources/implementation-playbook.mdfor detailed patterns and examples.
Worked example
Input: an Express application accepts a user's login and keeps the pre-login session ID. Read the bundled playbook, regenerate the session after credential verification, save only required identity fields, and verify that the old cookie cannot access /api/profile. Also test failed login, logout and store failure. Expected: successful login changes the session ID; failed login grants no access.
Inputs and prerequisites
Record the installed framework/SDK versions, identity provider, tenant model, credential store and test environment. Supply project-specific database adapters and request schemas; examples are integration sketches, not a runnable identity service.
Limitations
- JWT validation does not establish resource ownership; enforce tenant and object policy on reads and writes.
- Refresh rotation requires atomic persistence and concurrency tests; the issuance example alone does not provide it.
- Cookie flags do not replace CSRF protection, and secure-cookie behavior needs the actual HTTPS/proxy configuration tested.
- Provider integrations and password policies must be checked against current primary documentation and the application's threat model.
Related skills
- go-concurrency-patterns – Master Go concurrency with goroutines, channels, sync primitives, and context. Use when…
- ciso-review – /c-level-agents:ciso-review [plan] — Risk-paranoid interrogation of any plan that…
- grounded-vault – Use when maintaining a durable Markdown knowledge store that agents compile from…
- grpo-rlvr-training – Train reasoning and verifiable-task behavior with GRPO and reinforcement learning from…
- cmo-review – /c-level-agents:cmo-review [plan] — Narrative-first interrogation of positioning, ICP…
- code-reviewer – Use for any code review: a pull request, a diff, a commit, or a pasted function, handler…
- skill-installer – Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path…
- iso-standards-readiness – Prepares and structurally reviews readiness evidence for ISO management-system and…