Auth0
AuthCommonly used with
Skills using Auth0 (26)
moai-platform-auth
Authentication and authorization specialist covering Auth0, Clerk, and Firebase Auth. Use when implementing authentication, MFA, SSO, passkeys, WebAuthn, social login, or security features.
oauth2-resource-server
Use when configuring Spring Boot as an OAuth2 resource server, validating JWTs from an external auth provider (Keycloak, Auth0, Okta, Cognito), extracting claims, or implementing scope-based authorization.
authentication-identity-expert
Expert guide for implementing secure authentication, authorization (RBAC/ABAC), OAuth2, and identity management (Clerk, Auth.js, Supabase Auth) / Panduan ahli untuk autentikasi dan otorisasi.
oauth-2-0-setup
Implement OAuth 2.0 authentication flows including authorization code with PKCE, client credentials, and device code for secure API integration. Use when the user requests oauth 2 0 setup or provides relevant inputs for this workflow.
design-prd
Generate Product Requirements Documents through structured conversation for any project. Auto-detects tech stack, existing features, and data model from the codebase. Uses Firecrawl to research competitor products and UX patterns, Context7 to check framework capabilities for feasibility, and Supabase MCP to verify data model feasibility. Produces actionable PRDs with technical feasibility sections informed by real codebase analysis. Use when starting a new feature, documenting requirements, creating specs before implementation, or needing clarity on scope and success criteria.
auth
Authentication and authorization. JWT, OAuth2, OIDC, SAML, API keys, mTLS, MFA, passwordless, social login, session management, identity providers (Auth0, Okta, Cognito).
backend-validation
Use this skill when validating a backend API or WebSocket endpoint end-to-end, including acquiring an OIDC bearer token for authenticated calls. Trigger whenever the user asks to test/validate/smoke-check a backend, write a Hurl test, hit a WebSocket, acquire an access token, exercise an OIDC flow, debug a 401, or verify an endpoint works with real auth. Applies to projects that use Hurl for HTTP tests, websocat for WebSocket probes, and oauth2c or curl-based flows for token acquisition (Authentik, Keycloak, Okta, Auth0, any RFC 6749 / OIDC Core provider). Prefer this skill over ad-hoc curl + bash when the user has more than one endpoint to check, chained auth flows, or anything resembling a regression test — because the Hurl + cached-refresh-token pattern is 10× less code and survives the next session.
auth-patterns
Design authentication and authorization for the project's stack — JWT vs server sessions, refresh-token rotation, OAuth 2.1 + PKCE, magic links, passkeys (WebAuthn), TOTP/2FA + backup codes, RBAC vs ABAC vs ReBAC, secure cookie flags, mobile token storage. Use when adding sign-in to a new app, designing the token model between RN client and Go backend, integrating an identity provider (Better-Auth/Clerk/Auth0/WorkOS), planning password reset flows, or hardening an existing auth surface.
dev-auth
Modern web auth implementation (better-auth, Lucia, NextAuth/Auth.js, Clerk, Supabase Auth). Trigger when the user wants to add login, signup, sessions, OAuth, magic links, 2FA, or when existing auth code is detected to audit or migrate.
thinking-opportunity-cost
Evaluate decisions by what you give up, not just what you gain. Use for resource allocation, prioritization, build vs. buy choices, and technical debt evaluation.
web-vulnhunt
Authorized security testing methodology for web apps, APIs, multi-tenant SaaS, Spring Boot / Cloud Gateway stacks, FIDO/WebAuthn passwordless auth, mobile backends, and OAuth/SSO integrations. Use whenever the user asks to test, probe, scan, find vulnerabilities in, or pentest any web service — including bug bounty engagements, authorized pentests, CTF challenges, post-patch re-verification, CVSS scoring, subdomain/asset discovery, WAF/auth-filter bypass, **authorization bypass / IDOR / broken access control / missing @PreAuthorize / privilege escalation** testing, FIDO2/UAF testing, token-chain analysis, or writing vulnerability reports. Also triggers on the words "AcmeAuth", "Keycloak", "Okta", "PingFederate", "Auth0", or any passwordless-auth vendor. This is a defensive skill for authorized work only — always confirm scope before any active test.
rcode-migrate
Plan and execute the move from MVP to production-grade infrastructure without rewriting from.
expo-api-routes
Guidelines for creating API routes in Expo Router with EAS Hosting
identity-fabric
Concrete endpoints, probes, and enumeration techniques for identity provider fingerprinting and auth surface mapping. Covers Microsoft Entra (Azure AD), Okta, ADFS, Google Workspace, generic OIDC (Keycloak/Auth0/Ping/OneLogin/Duo), SAML metadata, AWS account-ID extraction, Microsoft 365 deep enumeration (Teams/SharePoint/OneDrive/OAuth/Power Platform), GraphQL field-suggestion enumeration when introspection is disabled, and LinkedIn employee enumeration with role prioritization. Use when mapping an org's auth architecture, enumerating SSO/IdP surfaces, or building a target employee list.
threat-model
Produce a short, concrete threat model before building a feature or app — assets, entry points, trust boundaries, and which parts a human must own. Use at the start of a project, before designing auth or payments, or when the user asks what could go wrong.
deploy
Check deploy status, trigger deploys, and debug deploy failures for the mattbutlerengineering monorepo. Covers static sites (Cloudflare Workers), API services (DigitalOcean App Platform), and infrastructure (Pulumi).
new-e2e-test
Scaffold a Playwright E2E test in one of the apps that has a Playwright config, matching the existing test fixtures and auth patterns
mcp-authorization
This skill should be used when the user mentions "MCP auth", "MCP OAuth", "MCP authorization", "OAuth 2.1", "OIDC", "access token validation", "audience", "resource server", "protected resource metadata", "token passthrough", "confused deputy", "Entra", "Okta", or securing a remote MCP server's identity and access. It provides the 2026-07-28 OAuth 2.1 / OIDC model for MCP servers as OAuth resource servers.
agent-jwt-validation
Taint-analysis agent specialized in insecure JWT access token validation. Receives source code of functions along a data-flow path and determines whether JWT tokens are validated according to all mandatory security rules (algorithm confusion, missing claim checks, forbidden header acceptance, size limit, revocation). Returns structured findings per .claude/skills/codebase-hotspotsv2/shared-rules.md.
api-security
OWASP API Security Top 10 (2023) with production Next.js App Router code — access control, authentication, input validation, rate limiting, security headers, data exposure, supply chain, SSRF
auth-flow-architect
Design authentication and authorization architectures - OAuth2/OIDC flow selection, JWT vs opaque tokens, refresh token rotation with reuse detection, session management and revocation, token storage rules per client type (SPA, mobile, server, M2M), the BFF pattern, RBAC/scopes/permissions modeling, and multi-tenant claims. Use when building or reviewing login/auth for an app, choosing between sessions and JWTs, integrating an identity provider (Auth0, Keycloak, Entra ID, Cognito), securing an SPA or mobile app, designing API-to-API auth, fixing token expiry/refresh bugs, or when the user asks how to do auth properly.
auth-setup
Use for Auth0 configuration - native application, callback/logout URLs, the Apple connection, and writing the public env vars (part of Stage 1 of SUBMISSION.md, only when the app uses auth)
spring-oauth2-resource-server
Configure a Spring Boot app as an OAuth2 resource server that validates JWT access tokens against any OIDC provider (Keycloak, Auth0, Okta, Cognito, Entra ID). Sets up the security filter chain, JWT decoder with audience validation, CORS, config properties, and a slice test. Use when adding token-based API authentication to a Spring Boot service.
hephaestus
Technical build planning and architecture. Translates an approved Athena scope doc into a concrete technical implementation plan. Invoke at the start of the Build station (lifecycle step 9) once the project is won and the brief is signed off.
caeculus
Frontend architecture plan or code review for React, Next.js, TypeScript, or headless WordPress. Invoke with a project brief, a file path to review, or a specific technical question.
convex-setup-auth
Sets up Convex authentication with user management, identity mapping, and access control. Use this skill when adding login or signup to a Convex app, configuring Convex Auth, Clerk, WorkOS AuthKit, Auth0, or custom JWT providers, wiring auth.config.ts, protecting queries and mutations with ctx.auth.getUserIdentity(), creating a users table with identity mapping, or setting up role-based access control, even if the user just says "add auth" or "make it require login."
Integration detected automatically from skill content. Some results may be false positives.