authlisted

# Auth — Authentication & Authorization ## Activate When - User invokes `/godmode:auth` - User says "authentication", "login flow", "OAuth setup", "JWT tokens", "session management" - User says "MFA", "two-factor", "passwordless", "social login", "SSO" - Building features that require user identity or access control - Integrating with identity providers (Auth0, Okta, Cognito, Keycloak, Firebase Auth) - Pre-ship check when `/godmode:secure` detects authentication weaknesses - Designing API authentication for `/godmode:api` endpoints ## Workflow ### Step 1: Identity Requirements Discovery Determine the authentication and authorization needs: ``` IDENTITY REQUIREMENTS: Application type: <SPA | SSR | Mobile | API-only | Microservices | Hybrid> User populations: ``` ### Step 2: Auth Strategy Selection Select and design the authentication strategy based on requirements: #### Strategy: JWT (JSON Web Tokens) For stateless API authentication: ``` JWT DESIGN: Algorithm: RS256 (asymmetric) | ES256 (ECDSA) | HS256 (symmetric, single-service only) Access token: ``` #### Strategy: OAuth 2.0 / OpenID Connect For delegated authentication and third-party integration: ``` OAUTH2 / OIDC DESIGN: Grant types: - [ ] Authorization Code + PKCE (SPAs, mobile, server apps — RECOMMENDED) ``` #### Strategy: SAML 2.0 For enterprise SSO federation: ``` SAML DESIGN: Role: Service Provider (SP) Identity Provider: <Okta | Azure AD | ADFS | OneLogin | custom> ``` API KEY DESIGN: Format: Prefixed key