skills.rest
alaminmain
alaminmainCOMMUNITY
Explore all skills by this author →
𝕏@alaminmainGitHub

auth-patterns

Explain OAuth 2.0, OpenID Connect, JWT, RBAC, and 2FA patterns for securing APIs.

Updated Dec 22, 2025
Search Tags:#authorization#authentication#middleware#RBAC#OAuth#JWT#OIDC
One-click install
npx skills add https://github.com/alaminmain/DoorAuthServer --skill auth-patterns-alaminmain
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-patterns
Source: https://github.com/alaminmain/DoorAuthServer/tree/main/.agent/skills/auth-patterns
Command: npx skills add https://github.com/alaminmain/DoorAuthServer --skill auth-patterns-alaminmain

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill consolidates authentication and authorization guidance to help developers design secure, scalable access control for APIs, services, and multi-tenant ecosystems.

Core Features & Use Cases

  • Pattern catalog: OAuth 2.0, OpenID Connect, JWT, RBAC, and 2FA guides.
  • Security integration: Middleware for protecting routes and validating tokens.
  • Use Case: Secure a multi-tenant API gateway with tenant-scoped access and role-based permissions across services.
  • Practical patterns: Naming conventions, permission structures, and token management strategies.

Quick Start

Start by enumerating resources, roles, and permissions, then wire in standard patterns (OAuth/OIDC, JWT, and RBAC) using your framework's middleware. Then test flows with sample clients and token verification.

Frequently Asked Questions about auth-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
When should I use OAuth 2.0, OpenID Connect, or JWTs for API authentication?▼

Use OAuth 2.0 for delegated access, OpenID Connect for user identity verification, and JWTs for stateless token management across distributed services. Your choice depends on whether you need third-party delegation, federated login, or self-contained API authorization.

How do I implement RBAC permission checks in a multi-tenant API?▼

Implement RBAC by enumerating resources, roles, and permissions, then wiring middleware to validate tenant-scoped tokens and enforce role-based access. This ensures users only access resources within their assigned tenant boundaries and role constraints.

What's the best way to secure routes with authentication middleware?▼

Secure routes by wiring authentication middleware to intercept requests, validate JWT signatures, and check OAuth scopes before reaching controllers. Apply RBAC permission checks within this middleware to enforce granular access control across your backend stack.

How does 2FA integrate with JWT and OAuth 2.0 flows?▼

2FA integrates by requiring an additional verification step during the OAuth 2.0 or OpenID Connect token issuance phase. Once verified, JWTs are issued with specific claims reflecting the elevated authentication level for subsequent API authorization checks.

Related Skills

Explore More Software Engineering Skills→
ryan-nguyen-01ryan-nguyen-01
4

skill-auth-rbac

Implement RBAC and PBAC with role hierarchies, guards, and JWT-embedded permissions.

Community
Advanced
thapaliyabikendrathapaliyabikendra
24

openiddict-authorization

Configure OpenIddict for OAuth 2.0 authorization in ABP Framework applications.

Community
Advanced
hopeoverturehopeoverture
6

auth-route-protection-checker

Identify missing authentication and authorization protections in Next.js routes, middleware, and server actions.

Community
Advanced
AI-Foundry-CoreAI-Foundry-Core
4

auth-implementation-patterns

Implement JWT, session, and OAuth2 authentication with RBAC for web APIs.

Official
Advanced