How does it handle security vulnerabilities?

The skill provides specific implementations for CSRF protection, token theft prevention, redirect URI validation, and nonce-based replay protection.

What authentication flows does this skill support?

It supports Authorization Code with PKCE (for web and mobile), standard Authorization Code, Client Credentials (for machine-to-machine), and OpenID Connect (OIDC) for identity.

Can I use this for mobile app development?

Yes, it specifically includes the PKCE (Proof Key for Code Exchange) flow, which is the industry-recommended standard for securing public clients like mobile and desktop apps.

Does it work with third-party providers like Google or Auth0?

Yes, it includes OIDC discovery logic to automatically fetch configuration details from any provider's .well-known/openid-configuration endpoint.

OAuth Flow Architect

Name: OAuth Flow Architect
Author: organvm-iv-taxis

byorganvm-iv-taxis

•

API Development

Designs and implements secure OAuth 2.0 and OpenID Connect (OIDC) authentication flows using modern best practices like PKCE and token management.

OAuth Flow Architect is a specialized Claude Code skill designed to guide developers through the complexities of modern authentication and identity management. It provides production-grade implementation patterns for various grant types, including Authorization Code with PKCE for web/mobile apps and Client Credentials for machine-to-machine communication. By focusing on critical security measures like CSRF protection, ID token validation, and OIDC discovery, this skill ensures that your authentication layer is robust, standards-compliant, and resilient against common vulnerabilities.

Key Features

012 GitHub stars

02OpenID Connect (OIDC) ID token validation and decoding

03Automated OIDC provider discovery and configuration

04Secure token lifecycle management including refresh and revocation

05Authorization Code Flow with PKCE implementation

06CSRF protection and redirect URI validation patterns

Use Cases

01Integrating 'Login with' functionality for Google, GitHub, or Auth0

02Securing mobile and Single Page Applications (SPAs) using PKCE

03Implementing service-to-service authentication for microservices

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add organvm-iv-taxis/a-i--skills oauth-flow-architect

For use in Claude.ai and ChatGPT

Key Features

012 GitHub stars

02OpenID Connect (OIDC) ID token validation and decoding

03Automated OIDC provider discovery and configuration

04Secure token lifecycle management including refresh and revocation

05Authorization Code Flow with PKCE implementation

06CSRF protection and redirect URI validation patterns

Use Cases

01Integrating 'Login with' functionality for Google, GitHub, or Auth0

02Securing mobile and Single Page Applications (SPAs) using PKCE

03Implementing service-to-service authentication for microservices

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add organvm-iv-taxis/a-i--skills oauth-flow-architect

For use in Claude.ai and ChatGPT