skills.rest
Lobbi-Docs
Lobbi-DocsOFFICIAL
Explore all skills by this author →
GitHub

authentication

Authenticate user credentials and authorize resource access with JWT, OAuth2, OIDC, and RBAC.

18|2|Updated Dec 12, 2025
Search Tags:#authorization#security#authentication#jwt#threat modeling#rbac#oidc#oauth2
One-click install
npx skills add https://github.com/Lobbi-Docs/claude --skill authentication-lobbi-docs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: authentication
Source: https://github.com/Lobbi-Docs/claude/tree/main/.claude/skills/authentication
Command: npx skills add https://github.com/Lobbi-Docs/claude --skill authentication-lobbi-docs

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires extended-thinking, deep-analysis, complex-reasoning.

What problem does it solve?

This Skill provides comprehensive guidance and code for implementing secure authentication and authorization, covering JWT, OAuth2, OIDC, session management, and RBAC, while also enabling deep security analysis and threat modeling to prevent vulnerabilities.

Core Features & Use Cases

  • JWT & Session Management: Generate and verify JWTs, hash passwords, and manage secure user sessions.
  • OAuth2 & OIDC: Implement various OAuth2 grant types (Auth Code, PKCE, Client Credentials) and OIDC ID token validation.
  • RBAC & Permissions: Define roles and permissions for fine-grained access control.
  • Security Analysis: Perform threat modeling (STRIDE) and vulnerability reviews (OWASP Top 10) for auth flows.
  • Use Case: You need to implement a new login flow for a multi-tenant application. Use this skill to design a secure OAuth2 Authorization Code Flow with PKCE, generate JWTs with tenant-specific claims, and perform a STRIDE threat model to identify and mitigate potential vulnerabilities like token replay or impersonation.

Quick Start

Use the authentication skill to generate Python code for creating a JWT access token for user 'user-123' with roles 'member' and 'viewer'.

Frequently Asked Questions about authentication

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement JWT authentication for login flows?▼

JWT authentication generates digitally signed tokens containing user claims that verify identity without server-side session storage. Create tokens with user ID and roles, set expiration times, and validate signatures on each request to secure login flows and API access across stateless services.

What's the difference between OAuth2 and OIDC for user authentication?▼

OAuth2 is an authorization framework delegating access to resources; OIDC adds an identity layer on top with ID tokens for authentication. Use OAuth2 for third-party app permissions and OIDC when you need verified user identity claims from an identity provider.

How do I set up role-based access control for different user permissions?▼

RBAC assigns users to roles, then maps roles to specific permissions for resources or actions. Define role hierarchies, embed role claims in tokens, and check permissions at authorization points to enforce fine-grained access control across your application.

Can I use PKCE with OAuth2 for mobile and single-page applications?▼

PKCE (Proof Key for Code Exchange) strengthens OAuth2 Authorization Code Flow for public clients by adding a code verifier to prevent authorization code interception. It is required for mobile apps and recommended for single-page applications to mitigate token theft.

How do I identify authentication vulnerabilities in my application?▼

Threat modeling with STRIDE and vulnerability reviews against OWASP Top 10 expose auth risks like token replay, credential stuffing, and session fixation. Analyze your login flow, token handling, and access checks to uncover and mitigate security gaps before deployment.

What's the best way to handle token refresh and session expiration?▼

Use short-lived access tokens with longer-lived refresh tokens to balance security and user experience. Implement refresh token rotation, set appropriate expiration times, validate token lifetimes on each request, and revoke tokens on logout to maintain secure sessions.

Related Skills

Explore More Software Engineering Skills→
markus41markus41
18

Keycloak FastAPI Integration

Integrate Keycloak into FastAPI with OpenID Connect and OAuth2 for JWT validation.

Community
Advanced
alexmaruccialexmarucci

audit-logs

Query and manage Datadog Audit Trail events through the Datadog API.

Community
Advanced
sumik5sumik5
2

AUTH-SECRETS

Enforce secure coding practices for authentication, authorization, and secrets management.

Community
Advanced
mjunaidcamjunaidca
27

better-auth-setup

Configures Better Auth OIDC Provider with PKCE and JWKS for centralized SSO.

Community
Advanced