What problem does it solve? Designing secure authentication and authorization flows is error-prone: missing refresh token rotation, weak tenant isolation, client-only MFA, and missing audit trails are common vulnerabilities. This Skill grounds identity flows in the project's approved baseline so implementations follow consistent, reviewed security patterns. ## Core Features & Use Cases - JWT with Token Rotation: Enforces short-lived access tokens, refresh token rotation, reuse detection, and revocation on password changes or security events. - Multi-Tenant Authorization: Requires explicit tenant resolution on every authenticated request, with RBAC or ABAC policies separated from authentication. - MFA and Audit Guidance: Covers TOTP enrollment, secret handling, and audit logging for sensitive operations like credential or permission changes. - Use Case: When building a login endpoint with refresh tokens in a NestJS multi-tenant app, activate this Skill to get the checklist, anti-patterns, and code patterns for rotation, tenant scoping, and revocation. ## Quick Start Ask the AI to design a login and refresh token flow with MFA and tenant isolation for the NestJS backend using this Skill.
