skills.rest
Smarter-Dev
Smarter-DevOFFICIAL
Explore all skills by this author →
WebsiteGitHub

skrift-oauth2

Implement OAuth2 hub/spoke authorization with PKCE and userinfo endpoints.

1|3|Updated Jun 17, 2025
Search Tags:#oauth2#pkce#hub-spoke#token-architecture#authorization-code#skrift#identity-federation
One-click install
npx skills add https://github.com/Smarter-Dev/smarter-dev --skill skrift-oauth2
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: skrift-oauth2
Source: https://github.com/Smarter-Dev/smarter-dev/tree/main/smarter_dev/.claude/skills/skrift-oauth2
Command: npx skills add https://github.com/Smarter-Dev/smarter-dev --skill skrift-oauth2

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Skrift can act as an OAuth2 Authorization Server (hub) so other Skrift instances (spokes) can authenticate users against it. Supports Authorization Code grant with PKCE (S256 only). Tokens are stdlib HMAC-SHA256 signed — no JWT library required.

Core Features & Use Cases

  • Hub/Spoke OAuth2 federation enabling secure sign-in across Skrift deployments
  • PKCE flow support (S256) for public clients and enhanced security
  • Token endpoints: /oauth/authorize, /oauth/token, /oauth/userinfo; token format is signed payload with type distinctions
  • Identity Federation: user claims retrieval and profile binding via userinfo

Quick Start

Configure a hub with a spoke client and register redirect URIs to enable Skrift OAuth2 authentication.

Frequently Asked Questions about skrift-oauth2

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up OAuth2 hub and spoke identity federation across multiple deployments?▼

OAuth2 hub and spoke identity federation is set up by configuring a central Skrift instance as the authorization server and registering other Skrift deployments as clients with designated redirect URIs. This enables secure federated authentication.

What is the Authorization Code flow with PKCE and why is it needed for public clients?▼

The Authorization Code flow with PKCE secures public clients by requiring a code verifier and challenge. It prevents authorization code interception attacks by binding the code to the originating request without needing a client secret.

Does this OAuth2 implementation require a JWT library for token signing?▼

No, this OAuth2 implementation does not require a JWT library. It uses stdlib HMAC-SHA256 signed payloads for token issuance, simplifying dependencies while maintaining secure token integrity for the authorization server.

How do I retrieve user profile claims after OAuth2 token exchange?▼

User profile claims are retrieved via the /oauth/userinfo endpoint after obtaining an access token. The userinfo endpoint provides user claims retrieval and profile binding for identity federation across hub and spoke deployments.

Can I use a different PKCE challenge method instead of S256?▼

No, you cannot use a different PKCE challenge method. This implementation supports S256 only, ensuring enhanced security for public clients by requiring the SHA-256 hash of the code verifier as the challenge.

Related Skills

Explore More Software Engineering Skills→
ryan-nguyen-01ryan-nguyen-01
4

skill-auth-oauth2

Implement OAuth2 and OpenID Connect authorization code flows with PKCE and JWKS token validation.

Community
Advanced
thapaliyabikendrathapaliyabikendra
24

authentication-authorization-patterns

Implement OAuth 2.0 and OpenID Connect authentication for .NET healthcare applications.

Community
Advanced
antonyfmunozantonyfmunoz

flask

Verify HMAC-SHA256 signatures and dispatch Flask webhook events by type.

Community
Intermediate
engineers-hub-ltd-in-house-projectengineers-hub-ltd-in-house-project

oauth2-flows

Implement OAuth 2.0 and OpenID Connect flows with PKCE and JWT verification.

Official
Advanced