auth-skill

JWT-based authentication and authorization for multi-user web APIs is implemented by securely hashing passwords with bcrypt or argon2, issuing JWT access and refresh tokens, validating tokens, and rotating them across user sessions. This Skill provides the blueprint for these workflows.

The best way to securely store user passwords during signup is to hash them using bcrypt or argon2 before storage. This approach protects against brute-force attempts and ensures credentials are never saved in plain text.

JWT token rotation and revocation works by issuing new access and refresh tokens after validation while invalidating previous tokens to prevent unauthorized access. This ensures safe token management and secure error handling across active sessions.

Better Auth integration can be used with existing user models for secure login. It aligns with security best practices to authenticate users and authorize access to protected resources within your application.

This authentication approach handles brute-force protection for login endpoints by combining secure password hashing with safe error handling. It ensures that signup and login workflows are protected against repeated access attempts.