# duende-skills

Skills and subagents for Duende IdentityServer, BFF work and token handling. Useful when an ASP.NET Core project needs sign-in, access rules or OAuth 2.0 wiring.

- plugin · `type=plugin` · Claude Code · ★ 9
- Author: Duende Software
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/DuendeSoftware/duende-skills
- Updated: 2026-10-16
- HTML: https://affpapa.org/en/nevibecode/plugins/duende-skills

## What it does

The plugin gives Claude skills on ASP.NET Core authentication and authorization: OIDC middleware, JWT Bearer, cookie schemes, access policies, scope checks in minimal APIs. Separate skills cover BFF and token management. Two subagents ship alongside them, `identity-server-specialist` and `oauth-oidc-specialist`.

Install through the marketplace and you get every skill at once. Need just one? Each lives in its own folder under `skills/`, so `npx skills add DuendeSoftware/duende-skills --skill duende-bff` pulls a single one. Worth knowing: `npx skills` handles skills only, so the subagents in `agents/` come from the plugin route instead.

The authors suggest pairing it with `dotnet-skills` for broader .NET coverage. It targets projects already on Duende or ASP.NET Core; on another stack there is nothing here for you.

## Install

### Claude Code (native platform)

**Plugin marketplace**
In the agent chat (not a shell):
```text
/plugin install duende-skills@claude-plugins-official
```
In the agent chat (not a shell):
```text
/plugin marketplace add anthropics/claude-plugins-official
```

## When to use it
- wire OIDC sign-in into ASP.NET Core without reading through scheme docs
- split authorization policies and requirement handlers into the right files
- add a BFF layer and keep token forwarding straight
- find API endpoints that skip scope checks
- map out IdentityServer clients and how they relate

## Example prompts
- Set up OIDC authentication in ASP.NET Core with JWT Bearer and a cookie scheme
- Work out why this authorization policy never fires on the endpoint
- Hook our IdentityServer up to a BFF and describe the token flow

## Similar
- [oauth-oidc-misconfiguration](https://affpapa.org/en/nevibecode/skills/oauth-oidc-misconfiguration.md) — skill · 3700 installs
- [authentication](https://affpapa.org/en/nevibecode/skills/codewithmukesh-authentication.md) — skill · 2800 installs
- [omni-auth](https://affpapa.org/en/nevibecode/skills/omni-auth.md) — skill · 1100 installs
- [auth0-authentication](https://affpapa.org/en/nevibecode/skills/auth0-authentication.md) — skill · 700 installs
- [api-authentication](https://affpapa.org/en/nevibecode/skills/secondsky-api-authentication.md) — skill · 533 installs
- [jwt-oauth-token-attacks](https://affpapa.org/en/nevibecode/skills/jwt-oauth-token-attacks.md) — skill · 3800 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md