skills.rest
aicodepro
aicodeproOFFICIAL
Explore all skills by this author →
GitHub

api-authentication

Implement JWT, OAuth 2.0, and API key authentication for Node.js and Flask APIs.

Updated Jun 22, 2026
Search Tags:#security#jwt#node.js#api keys#flask#api authentication#oauth 2.0
One-click install
npx skills add https://github.com/aicodepro/ai-agent-nexi --skill api-authentication-aicodepro
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-authentication
Source: https://github.com/aicodepro/ai-agent-nexi/tree/main/agent/skills/api-authentication
Command: npx skills add https://github.com/aicodepro/ai-agent-nexi --skill api-authentication-aicodepro

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jsonwebtoken, flask-jwt-extended, authlib, bcrypt, werkzeug, and includes references (resource) components.

What problem does it solve? Building secure API authentication is error-prone: weak token handling, missing header validation, and poor secret management lead to common vulnerabilities. This Skill provides production-oriented patterns for JWT, OAuth 2.0, and API key authentication so you avoid those mistakes. ## Core Features & Use Cases - JWT Authentication: Access and refresh token generation with middleware validation in Node.js (jsonwebtoken) and Flask (flask-jwt-extended), including role-based access control decorators. - OAuth 2.0 Integration: Google sign-in flow using Authlib with OpenID Connect discovery, user provisioning, and JWT issuance. - API Key Authentication: Secure key generation with secrets, SHA-256 hashing for storage, and usage tracking. - Security Hardening: Guidance on HTTPS, HttpOnly cookies, bcrypt password hashing, rate limiting, and security headers (HSTS, X-Frame-Options). - Use Case: You are adding login to a Flask API. Use this Skill to implement the /login and /refresh endpoints with role-based route protection, then add Google OAuth as a second sign-in method. ## Quick Start Ask the AI to implement JWT authentication with refresh tokens and role-based access control for your Flask or Express API.

Frequently Asked Questions about api-authentication

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement JWT authentication in Node.js?▼

Use the jsonwebtoken library to sign access tokens (15-minute expiry) and refresh tokens (7-day expiry) with separate secrets. Validate the Bearer token in middleware with jwt.verify and return 401 for malformed headers or invalid tokens.

How to add Google OAuth 2.0 login to a Flask app?▼

Use Authlib's Flask client with Google's OpenID Connect discovery URL, registering GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET from environment variables. After the callback exchanges the code for a token, find or create the user and issue a JWT.

Should I store JWT tokens in localStorage or cookies?▼

Store tokens in HttpOnly cookies, not localStorage, to prevent XSS-based token theft. Always serve your API over HTTPS and never transmit tokens in URLs.

How do I implement role-based access control with Flask JWT?▼

Embed the user's role in the JWT's additional claims at login, then use a decorator that calls get_jwt() to check the role against allowed roles, returning 403 for insufficient permissions.

How should API keys be stored securely?▼

Generate keys with secrets.token_urlsafe(32) and store only the SHA-256 hash in the database. On each request, hash the incoming key and compare it against stored hashes of active keys.

What are common JWT security mistakes to avoid?▼

Common mistakes include weak JWT secrets, ignoring token expiration, storing plain-text passwords, disabling HTTPS in production, and logging sensitive tokens. Use bcrypt with cost factor 12+ for passwords and rotate secrets regularly.

Related Skills

Explore More Software Engineering Skills→
heyflouaiheyflouai

ikf-rls-policy-designer

Design Supabase schemas and Row Level Security policies with role-based access.

Community
Intermediate
AutumnsGroveAutumnsGrove

api-integration

Automate REST API integration with authentication, rate limiting, retries, and caching.

Community
Advanced
RifteoRifteo
30

jwt-cracker

Automate JWT token testing and cracking to uncover vulnerabilities.

Official
Advanced
leonj1leonj1

auth-cognito

Manage user registration, login, logout, and tokens with Amazon Cognito.

Community
Intermediate