Does this skill support PKCE?

Yes, it provides implementation patterns for Authorization Code flow with PKCE, specifically designed for securing public clients like Single Page Applications (SPAs) and mobile apps.

Can I use this for SSO integrations?

Absolutely. This skill is optimized for building Single Sign-On (SSO) systems and integrating third-party identity providers using the OIDC standard.

Does it cover token security best practices?

Yes, the skill emphasizes critical security requirements such as storing tokens in HttpOnly cookies, implementing token rotation, and enforcing short-lived access tokens.

What authentication flows are included?

The skill includes patterns for Authorization Code flow (with and without PKCE), Client Credentials for service-to-service auth, and Refresh Token logic for session renewal.

OAuth Implementation

Name: OAuth Implementation
Author: secondsky

bysecondsky

•

Security & Testing

Implements secure OAuth 2.0 and OpenID Connect authentication flows for web and mobile applications.

About

This skill enables Claude to architect and implement industry-standard authentication systems using OAuth 2.0 and OpenID Connect (OIDC). It provides domain-specific patterns for Authorization Code flows, PKCE for public clients, and secure token management, ensuring that applications handle third-party integrations, SSO, and API access with production-grade security measures like HTTPS enforcement, state validation, and token rotation.

Key Features

PKCE support for SPAs and mobile apps
Secure token management and rotation
Security best practice enforcement
21 GitHub stars
Authorization Code flow implementation
OpenID Connect (OIDC) integration

Use Cases

Implementing secure API token refresh logic
Building secure SSO systems
Integrating third-party OAuth providers

About

Key Features

PKCE support for SPAs and mobile apps
Secure token management and rotation
Security best practice enforcement
21 GitHub stars
Authorization Code flow implementation
OpenID Connect (OIDC) integration

Use Cases

Implementing secure API token refresh logic
Building secure SSO systems
Integrating third-party OAuth providers