authenticate-apps

Name: authenticate-apps
Availability: InStock
Author: Motion

Add self-bootstrapping authentication to Fastify apps with scrypt-hashed credentials.

3|Updated Apr 11, 2026

Search Tags:#authentication #fastify #scrypt #session cookies #authorization gate #react login #iframe safe

Ready to run

npx skills add https://github.com/Motion-Creative/runneth-apps --skill authenticate-apps

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: authenticate-apps
Source: https://github.com/Motion-Creative/runneth-apps/tree/main/authenticate-apps
Command: npx skills add https://github.com/Motion-Creative/runneth-apps --skill authenticate-apps

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It solves the problem of leaving a Runneth sandbox app unprotected by adding a first-visit password setup and a persistent login gate so only authorized users can access the app.

Core Features & Use Cases

Self-bootstrapping credentials setup: the first browser visit creates a username and password via a /setup flow and persists credentials on disk.
Scrypt hashing + HMAC-signed sessions: passwords are scrypt-hashed and session cookies are signed with a separate random secret, enabling safer rotation behavior.
Gated access with allow-listed endpoints: everything is blocked behind /login except explicit allow-list paths like /api/health and the auth endpoints needed to sign in.
React-friendly JSON auth endpoints: supports programmatic login via /api/auth/status, /api/auth/login, and /api/auth/logout for frontend gating (including iframe-safe cookie behavior).

Quick Start

Ask the agent to install authenticate-apps into your sandbox Fastify app and then open the app URL once to complete setup at /setup.

Frequently Asked Questions about authenticate-apps

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I add password protection to a Fastify app?▼

To add password protection to a Fastify app, a plugin routes first-time visitors to a /setup page to create credentials, then gates all non-allow-listed requests behind a /login screen using scrypt hashing and HMAC-signed session cookies.

Can I use React login flows with Fastify session cookies?▼

Yes, React login flows work with Fastify session cookies via programmatic JSON auth endpoints like /api/auth/login, /api/auth/status, and /api/auth/logout, which support iframe-safe cookie behavior for frontend gating.

Do I need external dependencies to set up scrypt password hashing in Fastify?▼

No, you do not need external dependencies for scrypt password hashing in Fastify beyond Node built-ins and the Fastify framework itself, as the authentication layer uses manual cookie parsing and timing-safe comparisons.

How does a self-bootstrapping credentials setup work for sandbox apps?▼

A self-bootstrapping credentials setup works by routing the first browser visit to a /setup flow where users create a username and password, which are then scrypt-hashed and persisted to a configured credentials path on disk.

What is the best way to allow specific API endpoints to bypass Fastify authentication gates?▼

The best way to bypass Fastify authentication gates for specific endpoints is to use an allowPaths configuration, which exempts designated routes like /api/health and /api/auth/* from the login gate while blocking all other requests.

Are there limitations to using HMAC-signed session cookies for sandbox app authorization?▼

A limitation of using HMAC-signed session cookies for sandbox app authorization is that cookie rotation behavior depends on a separate random secret, and all non-allow-listed requests are strictly blocked unless properly authenticated.