skills.rest
nakano1122
nakano1122COMMUNITY
Explore all skills by this author →
Website𝕏@cafkaf1122GitHub

auth-design

Design secure authentication and authorization systems with RBAC, ABAC, OAuth/OIDC, and token/session management for web and mobile apps.

2|Updated Feb 15, 2026
Search Tags:#authorization#security#authentication#access control#RBAC#OAuth#ABAC
One-click install
npx skills add https://github.com/nakano1122/dotfiles --skill auth-design
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-design
Source: https://github.com/nakano1122/dotfiles/tree/main/dot_agents/skills/auth-design
Command: npx skills add https://github.com/nakano1122/dotfiles --skill auth-design

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides comprehensive guidance on designing secure and scalable authentication and authorization systems, preventing common vulnerabilities and ensuring proper access control.

Core Features & Use Cases

  • Authentication Patterns: Covers session-based, token-based (JWT), and passwordless (Passkey/WebAuthn) authentication.
  • Authorization Models: Details RBAC, ABAC, and resource-based access control for granular permission management.
  • OAuth/OIDC Integration: Guides on implementing secure third-party authentication flows.
  • Use Case: When designing a new web application, use this Skill to select the most appropriate authentication method, define user roles, and implement secure API access control.

Quick Start

Design an authentication flow for a new web application using token-based authentication with refresh tokens.

Frequently Asked Questions about auth-design

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is the best way to design authentication and authorization for a new web application?▼

To design authentication, select from session-based, token-based (JWT), or passwordless (Passkey/WebAuthn) methods, then apply RBAC or ABAC models for granular API access control and permission management.

How do RBAC and ABAC differ for access control implementation?▼

RBAC assigns permissions based on predefined user roles, while ABAC evaluates attributes like user properties, resource types, and environmental conditions to provide more granular, dynamic access control.

When should I use OAuth and OIDC for third-party authentication flows?▼

Use OAuth and OIDC when implementing secure third-party authentication flows for web or mobile applications, enabling delegated access and identity verification without exposing user credentials to the client.

How do I implement token management with refresh tokens for API authentication?▼

Implement token management by issuing short-lived access tokens alongside long-lived refresh tokens, requiring secure session handling and storage strategies to maintain authenticated states across web and mobile applications.

Do I need prior knowledge of security principles to use this authentication framework?▼

Yes, understanding security principles and common authentication protocols is required to effectively apply the provided patterns for session handling, token management, and API authentication strategies.

Can I use passwordless authentication like WebAuthn for mobile applications?▼

Yes, the framework covers passwordless authentication using Passkeys and WebAuthn alongside token-based and session-based methods, specifically addressing API authentication strategies for both web and mobile applications.

Related Skills

Explore More Software Engineering Skills→
DangQuangSEDangQuangSE
19

backend-mindset

Provide backend best practices for API design, security, and scalability.

Community
Advanced
EntroVyxEntroVyx
3

hunt-oauth

Identify OAuth 2.0 and OIDC vulnerabilities in web and mobile applications.

Community
Advanced
rnavarychrnavarych
14

role-backend:auth-implementation

Implement JWT authentication, RBAC authorization, and OAuth2/OIDC flows.

Community
Advanced
myapihqmyapihq
83

my-auth-api

Create OIDC identity providers and configure RS256 token verification.

Official
Advanced