When should the agent use this skill?

When implementing user authentication, securing REST or GraphQL APIs, adding OAuth2 or social login, implementing RBAC, designing session management, migrating auth systems, debugging auth issues, or implementing SSO or multi-tenancy.

What authentication strategies does it cover?

Session-based auth (server-stored state with a session ID cookie), token-based JWT (stateless and self-contained), and OAuth2/OpenID Connect for delegated authentication, social login, and enterprise SSO.

Authentication & Authorization Implementation Patterns

SkillSecurity

auth-implementation-patterns is a skill that guides an AI agent through designing and implementing authentication and authorization systems. It covers session-based, JWT, and OAuth2 strategies, plus RBAC and session management, along with secure practices like password hashing, short-lived tokens, secure cookies, rate limiting, and CSRF protection. It also lists common pitfalls, such as storing JWTs in localStorage and skipping server-side validation.

Use Authentication & Authorization Implementation Patterns in Claude, ChatGPT or Ahel Desktop

Free. Sign in, add Authentication & Authorization Implementation Patterns and connect your AI. About a minute.

Claude ChatGPT Ahel Desktop

Also: Claude Code · Cursor · Codex

Then ask your AI: use the Authentication & Authorization Implementation Patterns skill

Details

Instructions available. Your AI can read the instructions. Execution depends on the setup they require.

Account requirements not reviewed. Check the skill instructions before use; ahel provides instructions and does not run this skill.

No other account needed.

Have an AI agent that can load skills and read files.

Authentication & Authorization Implementation PatternsStart free

What your AI can do with it

Implement session-based, JWT, and OAuth2/OpenID Connect authentication strategies
Design role-based access control (RBAC) and permission checking
Apply secure practices: bcrypt/argon2 hashing, short-lived tokens, secure cookies, CSRF
Add rate limiting to auth endpoints and log security events
Avoid common pitfalls like JWT in localStorage and client-side-only auth checks
Support tasks like securing REST or GraphQL APIs, adding social login, SSO

Getting started

Have an AI agent that can load skills and read files.
Add the auth-implementation-patterns skill to the agent's available skills.
Ask the agent to implement or debug an auth system; it will use the skill when the task matches.
For deeper patterns and worked examples, have the agent read the referenced details.md file.

What this skill tells your AI

The instructions your AI receives, as published by wshobson/agents in plugins/developer-essentials/skills/auth-implementation-patterns/SKILL.md and read by ahel’s review.

Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.

When to Use This Skill

Implementing user authentication systems
Securing REST or GraphQL APIs
Adding OAuth2/social login
Implementing role-based access control (RBAC)
Designing session management
Migrating authentication systems
Debugging auth issues
Implementing SSO or multi-tenancy

Core Concepts

1. Authentication vs Authorization

Authentication (AuthN): Who are you?

Verifying identity (username/password, OAuth, biometrics)
Issuing credentials (sessions, tokens)
Managing login/logout

Authorization (AuthZ): What can you do?

Permission checking
Role-based access control (RBAC)
Resource ownership validation
Policy enforcement

2. Authentication Strategies

Session-Based:

Server stores session state
Session ID in cookie
Traditional, simple, stateful

Token-Based (JWT):

Stateless, self-contained
Scales horizontally
Can store claims

OAuth2/OpenID Connect:

Delegate authentication
Social login (Google, GitHub)
Enterprise SSO

Detailed patterns and worked examples

Detailed pattern documentation lives in references/details.md. Read that file when the navigation tier above is insufficient.

Best Practices

Never Store Plain Passwords: Always hash with bcrypt/argon2
Use HTTPS: Encrypt data in transit
Short-Lived Access Tokens: 15-30 minutes max
Secure Cookies: httpOnly, secure, sameSite flags
Validate All Input: Email format, password strength
Rate Limit Auth Endpoints: Prevent brute force attacks
Implement CSRF Protection: For session-based auth
Rotate Secrets Regularly: JWT secrets, session secrets
Log Security Events: Login attempts, failed auth
Use MFA When Possible: Extra security layer

Common Pitfalls

Weak Passwords: Enforce strong password policies
JWT in localStorage: Vulnerable to XSS, use httpOnly cookies
No Token Expiration: Tokens should expire
Client-Side Auth Checks Only: Always validate server-side
Insecure Password Reset: Use secure tokens with expiration
No Rate Limiting: Vulnerable to brute force
Trusting Client Data: Always validate on server

Signals

GitHub stars: 40k
Forks: 4k
Last commit: Sep 2026

Others that do the same job

auth-implementation-patterns
Skill · rudycity

Questions

When should the agent use this skill?: When implementing user authentication, securing REST or GraphQL APIs, adding OAuth2 or social login, implementing RBAC, designing session management, migrating auth systems, debugging auth issues, or implementing SSO or multi-tenancy.
What authentication strategies does it cover?: Session-based auth (server-stored state with a session ID cookie), token-based JWT (stateless and self-contained), and OAuth2/OpenID Connect for delegated authentication, social login, and enterprise SSO.

Advanced

Item type: skill
Key: auth-implementation-patterns-wshobson
Source: github.com/wshobson/agents

github.com/wshobson/agents