skills.rest
oborchers
oborchersCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

auth-and-api-keys

Design API authentication with API keys, OAuth 2.0, and JWTs.

28|3|Updated Feb 22, 2026
Search Tags:#authorization#authentication#oauth#jwt#api keys#http#api security
One-click install
npx skills add https://github.com/oborchers/fractional-cto --skill auth-and-api-keys
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-and-api-keys
Source: https://github.com/oborchers/fractional-cto/tree/main/api-design-principles/skills/auth-and-api-keys
Command: npx skills add https://github.com/oborchers/fractional-cto --skill auth-and-api-keys

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical need for secure and well-designed API authentication, covering API keys, OAuth, and JWTs to protect your services and ensure proper access control.

Core Features & Use Cases

  • API Key Management: Implement secure API key generation with prefixes, hashing, and scoping.
  • OAuth 2.0 Flows: Guide the implementation of standard OAuth flows for delegated access.
  • JWT Handling: Provide best practices for using short-lived JWTs in microservice architectures.
  • HTTP Status Codes: Ensure correct use of 401 (Unauthorized) and 403 (Forbidden) errors.
  • Use Case: When designing a new API, use this Skill to establish a secure authentication strategy, including how to issue and manage API keys with prefixes like sk_live_ and pk_test_, and how to handle token-based authentication for internal services.

Quick Start

Implement API key validation middleware that checks for Bearer tokens in the Authorization header.

Frequently Asked Questions about auth-and-api-keys

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement secure API key generation with prefixes and hashing?▼

Secure API key generation involves creating keys with recognizable prefixes like sk_live_ and pk_test_, hashing them for database storage, and applying scoping and rotation policies to maintain robust access control.

What is the correct HTTP status code to return for authentication vs authorization errors?▼

Use HTTP status code 401 (Unauthorized) when authentication fails or is missing, and 403 (Forbidden) when an authenticated user lacks the necessary permissions or scopes to access a specific resource.

How do I set up OAuth 2.0 flows for delegated API access?▼

Setting up OAuth 2.0 flows involves implementing standard authorization grant mechanisms to allow delegated access, issuing short-lived tokens, and validating Bearer tokens in the Authorization header.

When should I use JWTs in a microservices architecture?▼

Use short-lived JSON Web Tokens (JWTs) in microservices architectures for stateless, token-based authentication between internal services to securely transmit verified identity claims without repeated database lookups.

What is the best way to validate Bearer tokens in API requests?▼

The best way to validate Bearer tokens is by implementing API key validation middleware that intercepts requests, extracts the token from the Authorization header, and verifies its signature and scopes.

Related Skills

Explore More Software Engineering Skills→
Sim-hub22Sim-hub22

clerk-nextjs-patterns

Implement Clerk authentication patterns in Next.js with middleware and Server Actions.

Community
Advanced
gizixgizix
2

auth-system

Implement JWT authentication, RBAC, and protected endpoints for Flask applications.

Community
Advanced
MolcajeteAIMolcajeteAI
2

authorization-patterns

Implement RBAC and ABAC authorization patterns with TypeScript and Fastify.

Official
Advanced
qauth-labsqauth-labs
23

auth-engine

Define credential verification, token claim generation, and provider registration rules for QAuth.

Official
Intermediate