Does this skill follow the latest OAuth standards?

Yes, it implements OAuth 2.1, which consolidates best practices like mandatory PKCE for all clients and the removal of insecure grant types.

What are the technical requirements for this implementation?

The skill requires a Ruby on Rails 7+ application, Ruby 3.2 or higher, and a PostgreSQL database that supports encrypted columns.

How does it handle client secrets and token security?

The implementation utilizes Rails' native 'encrypts' declaration for at-rest security and employs timing-safe 'secure_compare' methods for all token and secret validations.

Can I use this for mobile and frontend applications?

Absolutely. By enforcing PKCE (Proof Key for Code Exchange), this provider is specifically designed to securely handle public clients like mobile apps and SPAs.

OAuth 2.1 Provider for Rails

Name: OAuth 2.1 Provider for Rails
Author: rbarazi

byrbarazi

0•

API開発

Implements a complete, RFC-compliant OAuth 2.1 authorization server within Ruby on Rails applications to secure third-party integrations.

This skill provides a comprehensive blueprint for building a secure, industry-standard OAuth 2.1 authorization server natively in Rails 7+. It covers every aspect of the specification, including PKCE for public clients, dynamic client registration, and OAuth metadata discovery. By providing domain-specific guidance on model architecture, token lifecycles, and security best practices like timing-safe comparisons and encryption at rest, this skill enables developers to transform their Rails apps into robust identity providers for third-party integrations, MCP clients, and secure API consumption.

主な機能

01Full RFC 8414 OAuth 2.1 metadata discovery layer

02PKCE-enforced authorization code flow for public and private clients

03RFC 7591 dynamic client registration (DCR) implementation

04Centralized token issuance, validation, and lifecycle management

050 GitHub stars

06Comprehensive audit logging and event tracking for security monitoring

ユースケース

01Building a central identity provider for a suite of internal or third-party applications

02Securing external API access for mobile apps and single-page applications (SPAs)

03Implementing Model Context Protocol (MCP) servers that require secure client authorization

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add rbarazi/agent-skills oauth21-provider

For use in Claude.ai and ChatGPT

Download Skill