Api Authentication

Solid reference for implementing JWT, OAuth 2.0, and API key authentication across Node.js and Python Flask. You get working middleware examples, a comparison table of auth methods with their security tradeoffs, and the critical security requirements like HttpOnly cookies and bcrypt cost factors. The code actually validates authorization headers properly instead of the naive split you see in too many tutorials. Use this when you're setting up authentication from scratch or debugging why your auth flow is failing. The security headers and common mistakes section will save you from the usual footguns like storing tokens in localStorage or logging sensitive data.

skills.sh installs: 549
GitHub stars: 248
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add secondsky/claude-skills --skill api-authentication --agent claude-code

Installs into .claude/skills of the current project.

Files

API Authentication

Implement secure authentication mechanisms for APIs using modern standards and best practices.

Authentication Methods

Method	Use Case	Security Level
JWT	Stateless auth, SPAs	High
OAuth 2.0	Third-party integration	High
API Keys	Service-to-service	Medium
Session	Traditional web apps	High

JWT Implementation (Node.js)

const jwt = require('jsonwebtoken');

const generateTokens = (user) => ({
  accessToken: jwt.sign(
    { userId: user.id, role: user.role },
    process.env.JWT_SECRET,
    { expiresIn: '15m' }
  ),
  refreshToken: jwt.sign(
    { userId: user.id, type: 'refresh' },
    process.env.REFRESH_SECRET,
    { expiresIn: '7d' }
  )
});

const authMiddleware = (req, res, next) => {
  const authHeader = req.headers.authorization;

  // Validate authorization header format
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'Malformed authorization header' });
  }

  const parts = authHeader.split(' ');
  if (parts.length !== 2) {
    return res.status(401).json({ error: 'Malformed authorization header' });
  }

SKILL.md on GitHub