auth-skill

Name: auth-skill
Availability: InStock
Author: phuhao

Implement OAuth and OIDC authentication with PKCE for third-party login providers.

Updated Jan 17, 2026

Search Tags:#authorization #authentication #oauth #session-management #oidc #access-control #account-merging

Ready to run

npx skills add https://github.com/phuhao00/real_deal --skill auth-skill-phuhao00

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: auth-skill
Source: https://github.com/phuhao00/real_deal/tree/main/.skills/auth-skill
Command: npx skills add https://github.com/phuhao00/real_deal --skill auth-skill-phuhao00

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps implement secure, production-ready authentication and authorization for the Real Deal platform, including third-party sign-in, account linking, and safe session handling.

Core Features & Use Cases

OAuth and OIDC Login: Support providers such as WeChat, Apple, Google, GitHub, LinkedIn, and Microsoft.
Account Binding and Merging: Link multiple identities to one user and prevent duplicate accounts.
Session and Token Security: Manage access tokens, refresh tokens, cookies, revocation, and CSRF protections.
Use Case: Add a new login provider, handle the callback, merge identities by verified email, and keep sessions secure across devices.

Quick Start

Ask for a secure OAuth login flow for the Real Deal platform with provider callbacks, account linking, and session management.

Frequently Asked Questions about auth-skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement OAuth and OIDC login flows with multiple providers like Google and GitHub?▼

OAuth and OIDC login flows use code flow with PKCE, state and nonce validation, and provider callbacks to securely integrate Google, GitHub, Apple, WeChat, LinkedIn, and Microsoft sign-in for your platform.

What is the best way to merge multiple third-party login identities into one account?▼

Account merging links multiple identities to one user by verifying shared email addresses, preventing duplicate accounts across providers. This handles identity binding securely while maintaining session continuity across devices.

How does session management work with refresh token rotation and CSRF protection?▼

Session management secures access tokens, refresh tokens, and cookies through token rotation and revocation mechanisms. CSRF protections validate state parameters, ensuring safe session handling across multiple devices and login states.

Can I add role-based access control to my existing OAuth authentication system?▼

Role-based access control integrates directly with OAuth authentication to enforce user permissions after identity verification. This applies authorization rules alongside secure token storage and session management across authenticated providers.

Does this authentication approach support both web and mobile session management?▼

Session management supports cross-device authentication by maintaining secure cookies, access tokens, and refresh token rotation. This ensures consistent login states across web and mobile platforms using OAuth and OIDC protocols.