auth-identity

Implementing OAuth2 and OIDC with PKCE for a single-page application requires choosing the correct authorization flow without a client secret, enforcing server-side token validation, and applying secure session practices to prevent token storage anti-patterns. This Skill guides that flow selection and enforcement.

Choosing between RBAC and ABAC for multi-tenant authorization depends on whether you need static role enforcement or dynamic attribute checks. This Skill helps decide between them, supports hybrid patterns with ownership checks, and ensures compliance-focused auditability across your protected resources.

DPoP token binding works alongside JWT refresh rotation to provide proof-of-possession and mitigate distributed forging risks. This Skill covers applying DPoP for token binding while remediating anti-patterns in safe session management and refresh token rotation across web and API scenarios.

Adding passkey and WebAuthn authentication to a mobile app involves implementing stronger identity security patterns for login and MFA. This Skill guides passkey-based flows, secure session management, and replay protection across mobile and service-to-service scenarios.

Server-side authorization checks for JWT-protected API endpoints are needed to enforce RBAC or ABAC controls consistently and prevent token forging. This Skill guides applying server-side permission checks, validating key security controls, and auditing access across web and machine-to-machine integrations.

You should not use OAuth2 client credentials flow for machine-to-machine service authentication when simpler mutual TLS or static API keys suffice and token lifecycle management adds unnecessary overhead. This Skill helps evaluate protocol flows and apply secure token practices appropriately for service-to-service scenarios.