Implement OAuth 2.1 with PKCE for CLI authentication flows.
npx skills add https://github.com/co-labs-co/context-harness --skill oauth-pkce-flow
Please help me install this Agent Skill. Skill: oauth-pkce-flow Source: https://github.com/co-labs-co/context-harness/tree/main/.opencode/skill/oauth-pkce-flow Command: npx skills add https://github.com/co-labs-co/context-harness --skill oauth-pkce-flow
CLI applications often struggle to securely authenticate users against external providers without exposing credentials or compromising tokens. This skill provides a PKCE-based OAuth 2.1 flow with secure token storage and automatic refresh, suitable for CLI tools and SDKs.
Authenticate a provider (for example, GitHub) by invoking the OAuth flow via the CLI (for example, context-harness mcp auth github) and complete the browser-based login. Tokens are stored securely and refreshed automatically.
High-intent search queries and answers about installing and using this skill.
OAuth 2.1 with PKCE secures CLI authentication by mandating the S256 method for public clients. It uses browser-based authorization and state CSRF protection to prevent credential exposure during the token exchange.
Secure token storage uses the system keyring with a file-based fallback for CLI tools. Automatic token refresh occurs using a 60-second expiration buffer to ensure valid credentials without requiring user intervention.
PKCE with S256 protects public clients by binding the authorization request to the token request using a hashed code challenge. This prevents interception attacks where a malicious actor might steal the authorization code from the browser flow.
Configurable provider templates allow you to easily add new OAuth providers to CLI tools and SDKs. You can authenticate a provider like GitHub by invoking the OAuth flow via the CLI and completing the browser-based login.
Automatic token refresh is supported with a 60-second expiration buffer to maintain valid sessions. When the stored tokens approach expiration, the flow automatically requests new tokens using the stored refresh token.
berkayoztuncPublish OAuth protected resource metadata via a .well-known endpoint and WWW-Authenticate headers.
Awais68Implement an Axios API client with JWT refresh and Zod validation.
Dev10x-GuruAutomate Slack token acquisition, keyring storage, and configuration file generation.
jpoutrinImplement OAuth 2.0 and OpenID Connect authorization code flows with PKCE.
