# oauth2-authentication

Guides your assistant through configuring OAuth2 and OpenID Connect flows. Helps secure API endpoints, configure PKCE for public clients, and manage access tokens.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 602 installs · ★ 62
- Author: manutej
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/manutej/luxor-claude-marketplace/tree/HEAD/plugins/luxor-backend-toolkit/skills/oauth2-authentication/SKILL.md
- Updated: 2026-06-13
- HTML: https://affpapa.org/en/nevibecode/skills/oauth2-authentication

## What it does

The skill provides step-by-step guidance on standard authorization patterns. It covers Authorization Code with PKCE for single-page and mobile apps, traditional server-side flows with client secrets, and Client Credentials for headless service-to-service communication. It also details the device authorization flow intended for CLI tools and connected displays.

Legacy patterns receive direct warnings: Implicit Flow and Resource Owner Password Credentials are flagged as security hazards. Public applications unable to safeguard a client secret must use PKCE, because skipping code verifier validation leaves auth code interception attacks wide open.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add manutej/luxor-claude-marketplace --skill oauth2-authentication -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/oauth2-authentication/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/oauth2-authentication/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add manutej/luxor-claude-marketplace --skill oauth2-authentication -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/oauth2-authentication/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add manutej/luxor-claude-marketplace --skill oauth2-authentication -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/oauth2-authentication/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install manutej/luxor-claude-marketplace oauth2-authentication
```

2. **Manually: put the files in place**
- File: `.github/skills/oauth2-authentication/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add manutej/luxor-claude-marketplace --skill oauth2-authentication -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/manutej/luxor-claude-marketplace --path plugins/luxor-backend-toolkit/skills/oauth2-authentication
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/oauth2-authentication/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add manutej/luxor-claude-marketplace --skill oauth2-authentication -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/manutej/luxor-claude-marketplace/tree/HEAD/plugins/luxor-backend-toolkit/skills/oauth2-authentication/SKILL.md

## When to use it
- configure Authorization Code with PKCE for single-page applications
- implement machine-to-machine auth via Client Credentials
- structure OAuth2 permission scopes for API endpoints
- replace insecure Implicit Flow patterns with code exchange flows

## Example prompts
- Implement PKCE authorization code exchange for our mobile client
- Set up a machine-to-machine Client Credentials flow between backend services
- Define OAuth2 scopes and validate incoming access tokens on our API

## Similar
- [oauth2-provider-design](https://affpapa.org/en/nevibecode/skills/oauth2-provider-design.md) — skill · 7800 installs
- [testing-oauth2-implementation-flaws](https://affpapa.org/en/nevibecode/skills/testing-oauth2-implementation-flaws.md) — skill · 350 installs
- [oauth-oidc-misconfiguration](https://affpapa.org/en/nevibecode/skills/oauth-oidc-misconfiguration.md) — skill · 3700 installs
- [authentication](https://affpapa.org/en/nevibecode/skills/codewithmukesh-authentication.md) — skill · 2800 installs
- [testing-api-authentication-weaknesses](https://affpapa.org/en/nevibecode/skills/testing-api-authentication-weaknesses.md) — skill · 484 installs
- [oauth-implementation](https://affpapa.org/en/nevibecode/skills/oauth-implementation.md) — skill · 719 installs

From the same set: [manutej/luxor-claude-marketplace](https://affpapa.org/en/nevibecode/by/manutej/luxor-claude-marketplace.md) — 65 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md