Loading...
Loading...
Found 4 Skills
Design the API-key authentication surface a platform issues to its own API consumers - key format with prefix+checksum conventions, hashed (irretrievable) vs encrypted (retrievable) storage, zero-downtime rotation with dual-key overlap, least-privilege scoping, individual vs org vs service-account ownership, self-service key dashboard behavior, and SOC 2 / PCI-DSS 4.0 lifecycle governance. Use whenever the user mentions API keys, secret keys, key prefixes, key rotation, key scoping, or revoking keys after an employee departure - even if they never say "API key management". Provider side only, not consuming another vendor's API. Do NOT use for OAuth authorization-server design - use samber/developer-platform-skills@oauth2-provider-design instead.
Design the OAuth2 authorization-server surface a B2B SaaS offers third-party apps - the OAuth 2.1 protocol baseline (PKCE for every client, no implicit or password grants, exact redirect matching), token TTL and refresh-rotation policy, scope taxonomy and granularity, consent-screen design with partial and incremental grants, client registration posture, and the tiered app-verification program. Use whenever the user mentions OAuth, "Sign in with X", access and refresh tokens, scopes, consent screens, PKCE, or third-party apps acting on a customer's behalf - even if they never say "OAuth provider". Issuer side only, not integrating against someone else's OAuth. Do NOT use for API-key design - use samber/developer-platform-skills@api-auth-key-management instead.
OAuth 2.1 / OIDC authorization server for Kotlin/Quarkus applications (in development)
Sa-Token OAuth2.0 server-side skill. Covers four grant modes: Authorization Code, Implicit, Password, and Client Credentials. Includes complete OAuth2-Server setup, the SaOAuth2DataLoader data loader, custom and tiered Scope permissions, the OIDC protocol, OpenId/UnionId, custom grant_type, custom login and authorization pages, annotation-based Access-Token validation, login session interoperability, Scope level control, and custom API routes. Use this skill when building an OAuth2.0 authentication server, developing an open platform, or implementing third-party application authorization. For basic login authentication, use the sa-token skill first.