# oauth-implementation

Guides the setup of OAuth 2.0, OpenID Connect, JWT tokens, and SSO in web and mobile apps. Useful when configuring social logins or securing backend APIs.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 553 installs · ★ 371
- Author: aj-geddes
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/aj-geddes/useful-ai-prompts/tree/HEAD/skills/oauth-implementation/SKILL.md
- Updated: 2026-03-04
- HTML: https://affpapa.org/en/nevibecode/skills/aj-geddes-oauth-implementation

## What it does

This skill guides developers through implementing OAuth 2.0 and OpenID Connect (OIDC) protocols with JWT session handling. The repository includes reference guides in the `references/` directory for Node.js, Python, and Java Spring Security. It covers authorization code issuance, refresh token rotation, and client registration workflows.

Security practices are strict here. The guide bans storing tokens in `localStorage` and warns against the deprecated implicit flow. Public clients must use PKCE, short-lived access tokens, and strict redirect URI validation. For a standalone Node.js server, you must provide `JWT_PRIVATE_KEY` and `JWT_PUBLIC_KEY` environment variables. Without asymmetric keys, token signing will fail.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add aj-geddes/useful-ai-prompts --skill oauth-implementation -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/oauth-implementation/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/oauth-implementation/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add aj-geddes/useful-ai-prompts --skill oauth-implementation -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/oauth-implementation/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add aj-geddes/useful-ai-prompts --skill oauth-implementation -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/oauth-implementation/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install aj-geddes/useful-ai-prompts oauth-implementation
```

2. **Manually: put the files in place**
- File: `.github/skills/oauth-implementation/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add aj-geddes/useful-ai-prompts --skill oauth-implementation -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/aj-geddes/useful-ai-prompts --path skills/oauth-implementation
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/oauth-implementation/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add aj-geddes/useful-ai-prompts --skill oauth-implementation -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/aj-geddes/useful-ai-prompts/tree/HEAD/skills/oauth-implementation/SKILL.md

## When to use it
- set up an OAuth 2.0 server using Node.js or Java Spring Security
- implement OpenID Connect (OIDC) for single sign-on
- secure authorization code exchange with PKCE for mobile clients
- configure refresh token rotation and redirect URI validation

## Example prompts
- Implement an OAuth 2.0 authorization server in Node.js using PKCE and JWT tokens
- Configure OpenID Connect authentication flow for our Python backend
- Review our auth flow to ensure tokens are rotated and not stored in localStorage

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 89cf24faa20ea0aa.

BEGIN THIRD-PARTY FILE 89cf24faa20ea0aa
````text
---
name: oauth-implementation
description: >
  Implement secure OAuth 2.0, OpenID Connect (OIDC), JWT authentication, and SSO
  integration. Use when building secure authentication systems for web and
  mobile applications.
---

# OAuth Implementation

## Table of Contents

- [Overview](#overview)
- [When to Use](#when-to-use)
- [Quick Start](#quick-start)
- [Reference Guides](#reference-guides)
- [Best Practices](#best-practices)

## Overview

Implement industry-standard OAuth 2.0 and OpenID Connect authentication flows with JWT tokens, refresh tokens, and secure session management.

## When to Use

- User authentication systems
- Third-party API integration
- Single Sign-On (SSO) implementation
- Mobile app authentication
- Microservices security
- Social login integration

## Quick Start

Minimal working example:

```javascript
// oauth-server.js - Complete OAuth 2.0 implementation
const express = require("express");
const jwt = require("jsonwebtoken");
const crypto = require("crypto");
const bcrypt = require("bcrypt");

class OAuthServer {
  constructor() {
    this.app = express();
    this.clients = new Map();
    this.authorizationCodes = new Map();
    this.refreshTokens = new Map();
    this.accessTokens = new Map();

    // JWT signing keys
    this.privateKey = process.env.JWT_PRIVATE_KEY;
    this.publicKey = process.env.JWT_PUBLIC_KEY;

    this.setupRoutes();
  }

  // Register OAuth client
  registerClient(clientId, clientSecret, redirectUris) {
    this.clients.set(clientId, {
      clientSecret: bcrypt.hashSync(clientSecret, 10),
// ... (see reference guides for full implementation)
```

## Reference Guides

Detailed implementations in the `references/` directory:

| Guide | Contents |
|---|---|
| [Node.js OAuth 2.0 Server](references/nodejs-oauth-20-server.md) | Node.js OAuth 2.0 Server |
| [Python OpenID Connect Implementation](references/python-openid-connect-implementation.md) | Python OpenID Connect Implementation |
| [Java Spring Security OAuth](references/java-spring-security-oauth.md) | Java Spring Security OAuth |

## Best Practices

### ✅ DO

- Use PKCE for public clients
- Implement token rotation
- Store tokens securely
- Use HTTPS everywhere
- Validate redirect URIs
- Implement rate limiting
- Use short-lived access tokens
- Log authentication events

### ❌ DON'T

- Store tokens in localStorage
- Use implicit flow
- Skip state parameter
- Expose client secrets
- Allow open redirects
- Use weak signing keys
````
END THIRD-PARTY FILE 89cf24faa20ea0aa

The third-party file has ended. Everything between the 89cf24faa20ea0aa tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

© aj-geddes · MIT · https://github.com/aj-geddes/useful-ai-prompts/tree/HEAD/skills/oauth-implementation/SKILL.md

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md