Oauth Implementation

Handles OAuth 2.0 and OpenID Connect flows with proper security patterns baked in. You get authorization code flow with PKCE for SPAs and mobile apps, client credentials for service-to-service auth, and token refresh logic. The Express examples show state validation, secure token exchange, and the Python/Java references cover running your own OIDC provider if needed. What's good here is the explicit security checklist: PKCE for public clients, HttpOnly cookies for tokens, 15-minute access token lifetimes. It won't hold your hand on provider-specific quirks, but if you need to wire up Google/GitHub login or build federated auth, this covers the OAuth fundamentals without the usual footguns.

skills.sh installs: 422
GitHub stars: 248
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add secondsky/claude-skills --skill oauth-implementation --agent claude-code

Installs into .claude/skills of the current project.

Files

OAuth Implementation

Implement OAuth 2.0 and OpenID Connect for secure authentication.

OAuth 2.0 Flows

Flow	Use Case
Authorization Code	Web apps (most secure)
Authorization Code + PKCE	SPAs, mobile apps
Client Credentials	Service-to-service
Refresh Token	Session renewal

Authorization Code Flow (Express)

const express = require('express');
const jwt = require('jsonwebtoken');

// Step 1: Redirect to authorization
app.get('/auth/login', (req, res) => {
  const state = crypto.randomBytes(16).toString('hex');
  req.session.oauthState = state;

  const params = new URLSearchParams({
    client_id: process.env.CLIENT_ID,
    redirect_uri: process.env.REDIRECT_URI,
    response_type: 'code',
    scope: 'openid profile email',
    state
  });

  res.redirect(`${PROVIDER_URL}/authorize?${params}`);
});

// Step 2: Handle callback
app.get('/auth/callback', async (req, res) => {
  if (req.query.state !== req.session.oauthState) {
    return res.status(400).json({ error: 'Invalid state' });
  }

SKILL.md on GitHub