PlugWiki

Auth Implementation Patterns Skill (wshobson) for Claude Code

auth-implementation-patterns (from the wshobson/agents collection) gives Claude patterns for login, tokens, sessions, OAuth2 and role-based access control.

Installs
20.3K
on skills.sh
Stars
42.1K
on GitHub
Files
1
besides SKILL.md
Updated
Oct 2026
last repo commit

The skill loads when you implement authentication, secure REST or GraphQL APIs, add OAuth2 or role-based access control, or debug auth issues. SKILL.md explains authentication versus authorization, then compares session-based, token-based (JWT) and OAuth2 / OpenID Connect approaches.

It ends with a list of 10 best practices and 7 common pitfalls. These include hashing passwords with bcrypt or argon2, short-lived access tokens of 15 to 30 minutes, and not keeping JWTs in localStorage.

The worked code is in references/details.md: JWT and refresh tokens, Express sessions, OAuth2 with Passport.js, RBAC, permission-based and ownership checks, password hashing and rate limiting. The examples read secrets such as JWT_SECRET and SESSION_SECRET from environment variables.

Good for

  • Backend developers adding login or securing an API
  • Teams adding OAuth2 social login or SSO
  • Developers debugging auth bugs or reviewing access checks

Install auth-implementation-patterns

Claude Code

  1. 1

    Copy this prompt.

    Install the auth-implementation-patterns skill in Claude Code. Run this command:

npx skills add https://github.com/wshobson/agents --skill auth-implementation-patterns

Then check that it loaded and tell me how to use it.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

From its listing on skills.sh. Source.

What's in the skill

When it loads

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

Sections in SKILL.md

  1. When to Use This Skill
  2. Core Concepts
  3. 1. Authentication vs Authorization
  4. 2. Authentication Strategies
  5. Detailed patterns and worked examples
  6. Best Practices
  7. Common Pitfalls

Key facts

Author
wshobson (GitHub: wshobson)
Repo
wshobson/agents
Installs on skills.sh
20,347 as of 2026-11-02
GitHub stars (whole repo)
42,081 as of 2026-11-02
License
MIT
Last repo commit
2026-10-30
Files in the skill folder
2 files including SKILL.md
skills.sh audits
Gen Agent Trust Hub pass, Socket pass, Snyk pass

What it includes

  • AuthN vs AuthZ, sessions, JWT, OAuth2 and OpenID Connect

    Short comparison of the three authentication strategies and what each means for state and scaling.

    Core concepts

  • Token generation, verification and refresh flow

    In references/details.md. Two patterns: JWT implementation and a refresh token flow.

    JWT authentication

  • Express session with Redis

    In references/details.md, for traditional cookie-based sessions.

    Session-based authentication

  • OAuth2 with Passport.js

    In references/details.md, for sign-in with an outside provider.

    OAuth2 / social login

  • RBAC, permission-based and resource ownership

    Three patterns in references/details.md for deciding what a signed-in user may do.

    Authorization patterns

  • Password hashing and rate limiting patterns

    Two patterns in references/details.md, plus the 10-point best-practices list and 7 pitfalls in SKILL.md.

    Security best practices

From the official docs

Questions

What does the auth-implementation-patterns skill do?

It gives Claude a guide to authentication and authorization: JWT, sessions, OAuth2, role-based access control, password security and rate limiting, with code examples to adapt.

How do I install it in Claude Code or Codex?

Use the install box above. The skills CLI command installs only this skill. The wshobson/agents README also documents gh skill install wshobson/agents auth-implementation-patterns, which needs GitHub CLI 2.90 or later, and plugin installs for Claude Code and Codex.

Does it need an API key?

No key is needed for the skill. The examples in references/details.md read environment variables such as JWT_SECRET, JWT_REFRESH_SECRET, SESSION_SECRET, REDIS_URL, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET and FRONTEND_URL, which you create yourself.

Is it safe to install?

It bundles no scripts: SKILL.md plus one reference file of TypeScript examples. Claude writes auth code from them, and the examples touch Redis sessions, password hashing and OAuth credentials. Our advice: review every auth change line by line, keep real secrets out of chat, and have a person check security-sensitive code.

Which languages does it cover?

The examples use TypeScript and Node.js tools such as Express, Passport.js and jsonwebtoken. SKILL.md itself is language-neutral in its concepts and best practices.

Does it replace an auth library or service?

No. It teaches patterns for Claude to follow when building. SKILL.md lists using HTTPS, hashed passwords, short-lived tokens and rate limits, but it does not provide the login system itself.

Information

updated Nov 2, 2026

Repository
wshobson/agents
Folder
plugins/developer-essentials/skills/auth-implementation-patterns

wshobson/agentsskills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 3
  1. auth-implementation-patterns SKILL.md · github.com
  2. auth-implementation-patterns details.md · github.com
  3. wshobson/agents README · github.com

Updated Nov 2, 2026.