Api Authentication

This covers the core authentication patterns you'll actually use: JWT tokens, OAuth 2.0, API keys, and session management. The references include working implementations in both Node.js and Python, with examples for login flows, token refresh, and middleware protection. It's opinionated about security basics like HttpOnly cookies, bcrypt for passwords, and HTTPS everywhere. The best practices section is genuinely helpful, calling out common mistakes like storing tokens in URLs or logging credentials. If you're building an API and need to lock it down properly, this gives you the patterns and code to start from rather than piecing together blog posts.

skills.sh installs: 612
GitHub stars: 379
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add aj-geddes/useful-ai-prompts --skill api-authentication --agent claude-code

Installs into .claude/skills of the current project.

Files

Overview

Implement comprehensive authentication strategies for APIs including JWT tokens, OAuth 2.0, API keys, and session management with proper security practices.

When to Use

Securing API endpoints
Implementing user login/logout flows
Managing access tokens and refresh tokens
Integrating OAuth 2.0 providers
Protecting sensitive data
Implementing API key authentication

Quick Start

Minimal working example:

// Node.js JWT Implementation
const express = require('express');
const jwt = require('jsonwebtoken');
const bcrypt = require('bcrypt');

const app = express();
const SECRET_KEY = process.env.JWT_SECRET || 'your-secret-key';
const REFRESH_SECRET = process.env.REFRESH_SECRET || 'your-refresh-secret';

// User login endpoint
app.post('/api/auth/login', async (req, res) => {
  try {
    const { email, password } = req.body;

SKILL.md on GitHub