skills.rest
rohitg00
rohitg00COMMUNITY
Explore all skills by this author →
𝕏@ghumare64GitHub

authentication-patterns

Designs OAuth2, JWT, RBAC and PKCE authentication for modern apps and APIs.

2.5k|877|Updated Feb 4, 2026
Search Tags:#authorization#security#authentication#jwt#rbac#oauth2#pkce
One-click install
npx skills add https://github.com/rohitg00/awesome-claude-code-toolkit --skill authentication-patterns-rohitg00
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: authentication-patterns
Source: https://github.com/rohitg00/awesome-claude-code-toolkit/tree/main/skills/authentication-patterns
Command: npx skills add https://github.com/rohitg00/awesome-claude-code-toolkit --skill authentication-patterns-rohitg00

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Authentication and authorization design in modern apps is error-prone and hard to standardize.

Core Features & Use Cases

  • JWT-based token management for API security
  • OAuth2 Authorization Code Flow with PKCE and session handling
  • RBAC and permission models across services
  • Security best practices and common anti-patterns
  • Use cases for APIs, SPAs, and enterprise portals

Quick Start

Implement a baseline authentication workflow by integrating OAuth2 with PKCE for public clients, issuing short-lived access tokens and long-lived refresh tokens, and enforcing RBAC across protected endpoints.

Frequently Asked Questions about authentication-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement OAuth2 with PKCE for a public client?▼

Implement OAuth2 with PKCE for public clients by integrating the authorization code flow, issuing short-lived access tokens, and managing long-lived refresh tokens for secure session handling.

What is the best way to manage JWT token lifecycles in microservices?▼

Manage JWT token lifecycles by issuing short-lived access tokens to reduce exposure windows and using long-lived refresh tokens to maintain secure user sessions across your microservices.

How do I enforce RBAC permissions across protected API endpoints?▼

Enforce RBAC across protected API endpoints by applying role-based permission models to validate user privileges, ensuring strict authorization checks on every service request.

What are common authentication anti-patterns in web applications?▼

Common authentication anti-patterns include improper token storage, missing PKCE flows for public clients, and overlong access token lifespans, which compromise API security and session integrity.

Can I use this for securing both SPAs and enterprise portals?▼

Yes, you can secure SPAs and enterprise portals by applying standardized authentication workflows, OAuth2 flows, and RBAC models tailored for both single-page and enterprise-scale applications.

When should I use short-lived access tokens instead of long-lived sessions?▼

Use short-lived access tokens for API security to minimize token theft risk, pairing them with long-lived refresh tokens to maintain seamless session handling without compromising security.

Related Skills

Explore More Software Engineering Skills→
duranserkanduranserkan
20

test-integration-api

Bootstrap an ASP.NET Core test host with authentication and HTTP mocking.

Community
Advanced
spoonbobospoonbobo

auth-rbac

Manages Trinity AGI authentication and RBAC with JWTs and audit logging.

Community
Advanced
sbalagan22sbalagan22

nextjs-supabase-auth

Integrate Supabase Auth with Next.js App Router for middleware-protected routes.

Community
Advanced
wilfriedagowilfriedago
2

keycloak-administration

Configure Keycloak realms, clients, and authentication flows for SSO.

Community
Advanced