auth-patternslisted

# Auth Patterns — Sessions, Tokens, Identity Practical authentication + authorization patterns for the project's stack: React Native client → Go+Fiber business backend → Python+FastAPI AI adapter → PostgreSQL. Designed around 2026-current best practices and the realistic threat model of a consumer mobile app. ## When to Use This Skill - Adding sign-in to a new service. - Choosing JWT vs opaque sessions for the RN ↔ Go ↔ FastAPI token chain. - Designing refresh-token rotation + revocation. - Integrating a hosted identity provider (Better-Auth, Clerk, Auth0, WorkOS). - Implementing magic-link / OTP / passkey flows. - Adding 2FA (TOTP + backup codes). - Defining the permissions model — RBAC vs ABAC vs ReBAC. - Designing the password reset flow (it's the most-broken thing in most apps). - Hardening an existing auth surface — cookie flags, CSRF, header rules. ## Default Stack — One Sentence **Server-side opaque sessions stored in Postgres + a short-lived signed access JWT for service-to-service hops.** The RN app holds the opaque session token in Keychain/Keystore. The Go backend exchanges that for a 5-minute service JWT when it needs to call the FastAPI AI adapter. No long-lived JWTs anywhere on the client. This combines the revocability of sessions, the statelessness of JWTs where it matters (between services), and the robust mobile storage of native secure stores. For the alternatives and when each is right, see [references/sessions-vs-jwt.md](references/sessions-vs-jwt.