authenticationlisted

Implement API authentication — JWT, OAuth2, API keys, and session management. Use when implementing login, choosing an auth strategy, securing endpoints, or debugging token issues.
ecoma-io/touchstone · ★ 1 · API & Backend · score 58

Install: claude install-skill ecoma-io/touchstone

# Authentication - JWT: short-lived access tokens (15min) + long-lived refresh tokens. Never store sensitive data in the payload. - OAuth2: use authorization code flow with PKCE. Implicit flow is deprecated. - API keys: simplest for service-to-service. Rotate regularly. Never in URLs. - Session tokens: httponly, secure, SameSite=Strict cookies - Auth check must happen before any business logic — middleware, not handler