Build secure API authentication systems with OAuth2, JWT, API keys, and session management. Use when implementing secure authentication flows. Trigger with phrases like "build authentication", "add API auth", or "secure the API".
npxskills add jeremylongshore/claude-code-plugins-plus-skills--skill building-api-authenticationLoading…
Build secure API authentication systems supporting JWT Bearer tokens, OAuth 2.0 authorization code and client credentials flows, API key management, and session-based authentication. Implement token issuance, validation, refresh rotation, revocation, and role-based access control (RBAC) with scoped permissions across all API endpoints.
jsonwebtoken (Node.js), PyJWT (Python), or jjwt (Java)sub (user ID), iat, exp (15-minute access token), , and in the payload.rolesscopesAuthorization header, verifies the signature and expiration, and injects the decoded user context into the request object.user.roles against endpoint-required roles, supporting both role-level (admin, user) and scope-level (read:users, write:orders) authorization.X-API-Key header.See ${CLAUDE_SKILL_DIR}/references/implementation.md for the full implementation guide.
${CLAUDE_SKILL_DIR}/src/auth/jwt.js - JWT token issuance, verification, and refresh logic${CLAUDE_SKILL_DIR}/src/auth/middleware.js - Bearer token authentication middleware${CLAUDE_SKILL_DIR}/src/auth/rbac.js - Role-based and scope-based access control middleware${CLAUDE_SKILL_DIR}/src/auth/api-keys.js - API key generation, hashing, and validation${CLAUDE_SKILL_DIR}/src/auth/oauth.js - OAuth 2.0 flow implementations${CLAUDE_SKILL_DIR}/src/routes/auth.js - Login, register, refresh, and logout endpoints${CLAUDE_SKILL_DIR}/tests/auth/ - Authentication and authorization security tests| Error | Cause | Solution |
|---|---|---|
| 401 Token Expired | JWT exp claim is in the past | Client should attempt token refresh; if refresh fails, redirect to login |
| 401 Invalid Signature | JWT signed with different key or tampered payload | Verify signing key matches between issuance and validation; check for key rotation issues |
| 403 Insufficient Scope | Authenticated user lacks required role/scope for endpoint | Return required scope in error body; log authorization failure with user and endpoint details |
| Refresh token reuse | Previously rotated refresh token used (possible token theft) | Invalidate all user sessions immediately; alert user of potential compromise; require re-authentication |
| API key leaked | API key exposed in client-side code, logs, or version control | Revoke compromised key immediately; issue replacement; scan for exposure source |
Refer to ${CLAUDE_SKILL_DIR}/references/errors.md for comprehensive error patterns.
JWT with refresh rotation: Login returns {accessToken (15min), refreshToken (30d)}; client stores refresh token securely; on 401, client calls POST /auth/refresh with old refresh token, receives new pair, old refresh token is invalidated.
Multi-provider OAuth: Support "Sign in with Google" and "Sign in with GitHub" using OAuth 2.0 authorization code flow, creating local user accounts on first sign-in and linking subsequent provider connections.
API key with scoped permissions: Generate API keys with specific scopes (read:analytics, write:webhooks), stored as SHA-256 hashes, displayed to the user only once at creation, with key rotation support.
See ${CLAUDE_SKILL_DIR}/references/examples.md for additional examples.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Transcribe audio via OpenAI Audio Transcriptions API (Whisper).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Transcribe audio via OpenAI Audio Transcriptions API (Whisper).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.