Api authentication

Skill ulpi-io/plugin-marketplace/plugins/aj-geddes/skills/api-authentication

A curated collection of 7,800+ agent skills for Claude Desktop, sourced from skills.sh

Install

npx -y skills add ulpi-io/plugin-marketplace --skill api-authentication

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Implement secure API authentication with JWT, OAuth 2.0, API keys, and session management. Use when securing APIs, managing tokens, or implementing user authentication flows.

SKILL.md

2.8 KB, 580 tokens by cl100k_base, as published. Nobody here has run it

Overview

Implement comprehensive authentication strategies for APIs including JWT tokens, OAuth 2.0, API keys, and session management with proper security practices.

When to Use

Securing API endpoints
Implementing user login/logout flows
Managing access tokens and refresh tokens
Integrating OAuth 2.0 providers
Protecting sensitive data
Implementing API key authentication

Quick Start

Minimal working example:

// Node.js JWT Implementation
const express = require('express');
const jwt = require('jsonwebtoken');
const bcrypt = require('bcrypt');

const app = express();
const SECRET_KEY = process.env.JWT_SECRET || 'your-secret-key';
const REFRESH_SECRET = process.env.REFRESH_SECRET || 'your-refresh-secret';

// User login endpoint
app.post('/api/auth/login', async (req, res) => {
  try {
    const { email, password } = req.body;

    // Find user in database
    const user = await User.findOne({ email });
    if (!user) {
      return res.status(401).json({ error: 'Invalid credentials' });
    }

    // Verify password
    const isValid = await bcrypt.compare(password, user.password);
    if (!isValid) {
      return res.status(401).json({ error: 'Invalid credentials' });
    }
// ... (see reference guides for full implementation)

Reference Guides

Detailed implementations in the references/ directory:

Guide	Contents
JWT Authentication	JWT Authentication
OAuth 2.0 Implementation	OAuth 2.0 Implementation
API Key Authentication	API Key Authentication
Python Authentication Implementation	Python Authentication Implementation

Best Practices

✅ DO

Use HTTPS for all authentication
Store tokens securely (HttpOnly cookies)
Implement token refresh mechanism
Set appropriate token expiration times
Hash and salt passwords
Use strong secret keys
Validate tokens on every request
Implement rate limiting on auth endpoints
Log authentication attempts
Rotate secrets regularly

❌ DON'T

Store passwords in plain text
Send tokens in URL parameters
Use weak secret keys
Store sensitive data in JWT payload
Ignore token expiration
Disable HTTPS in production
Log sensitive tokens
Reuse API keys across services
Store credentials in code