authentication-patterns

Implement JWT, OAuth 2.0, and RBAC authentication workflows for backends.

1|Updated Jan 4, 2026

Search Tags:#authentication #oauth #jwt #rbac #mfa #token-management #password-hashing

Ready to run

npx skills add https://github.com/karchtho/my-claude-marketplace --skill authentication-patterns

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: authentication-patterns
Source: https://github.com/karchtho/my-claude-marketplace/tree/main/bundles/express-backend-bundle/skills/authentication-patterns
Command: npx skills add https://github.com/karchtho/my-claude-marketplace --skill authentication-patterns

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Implementing secure, scalable authentication and authorization in backends is complex and error-prone. This skill provides patterns for JWTs, OAuth 2.0, session management, password hashing, MFA, and API keys to standardize and accelerate secure access control.

Core Features & Use Cases

JWT-based authentication with access and refresh tokens, token verification, and rotation.
Password hashing, password reset flows, and secure credential storage.
OAuth 2.0 integration patterns (e.g., Google) and social sign-in workflows.
API key generation and usage for service-to-service authentication.
Role-based access control (RBAC) and MFA integration for sensitive operations.
Secure session management and token storage strategies across APIs.

Quick Start

Integrate these authentication patterns into your backend by wiring the provided code examples and configuring secrets, storage, and strategy choices for your environment.

Frequently Asked Questions about authentication-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement JWT authentication with access and refresh tokens in my backend?▼

Implement JWT authentication by generating access and refresh tokens upon login, verifying token signatures on protected routes, and rotating refresh tokens to maintain secure backend sessions. This approach standardizes token management while mitigating interception threats.

What is the best way to integrate OAuth 2.0 social sign-in for a web API?▼

OAuth 2.0 integration for web APIs involves routing users to external providers like Google, retrieving authorization codes, and exchanging them for access tokens. This pattern standardizes social sign-in workflows and securely delegates identity verification.

How does role-based access control (RBAC) work with API keys for microservices?▼

RBAC combined with API keys restricts microservice access by mapping generated API keys to specific roles and permissions. Service-to-service requests are authenticated by validating the API key against enforced RBAC policies before authorizing sensitive operations.

Can I use these authentication patterns to implement secure password reset flows and credential storage?▼

Yes, you can use these authentication patterns to implement secure password reset flows by applying robust password hashing and secure credential storage. This ensures passwords are never stored in plaintext and reset tokens are safely managed and verified.

When do I need MFA integration in my backend authentication workflow?▼

MFA integration is needed when securing sensitive operations beyond standard login, adding an extra verification layer like a token or biometric prompt. This pattern enforces best practices for threat mitigation across web APIs and microservices.