Agent skill · security · erichowens
oauth-oidc-implementer
Expert in implementing OAuth 2.0 and OpenID Connect (OIDC) authentication flows. Specializes in secure token handling, social login integration, API authorization, and identity provider configuration.
Why this skill is useful
Provides detailed implementation patterns and security best practices for OAuth 2.0 and OIDC that the AI wouldn't reliably generate on its own.
What it needs
About 5k tokens when loaded. Last updated 2026-07-14. 180 stars on the source repository.
What this skill does
OAuth/OIDC Implementer Overview Expert in implementing OAuth 2.0 and OpenID Connect (OIDC) authentication flows. Specializes in secure token handling, social login integration, API authorization, and identity provider configuration. Handles both client-side and server-side flows with security best practices. When to Use Implementing "Login with Google/GitHub/etc." social login Setting up OAuth 2.0 for API authorization Configuring OIDC for enterprise SSO Designing token refresh and session management Implementing PKCE for mobile/SPA applications Securing API endpoints with JWT validation Integrating with identity providers (Auth0, Okta, Keycloak) Troubleshooting OAuth flow failures Capabilities OAuth 2.0 Flows Authorization Code flow (with PKCE) Client Credentials flow for service-to-service Implicit flow (legacy, understand why to avoid) Device Authorization flow for IoT Refresh token rotation OpenID Connect ID token validation and claims UserInfo endpoint usage Discovery document (.well-known/openid-configuration) Session management (front-channel/back-channel logout) PKCE for public clients Token Management JWT structure (header, payload, signature) Access token vs ID token vs refresh token Token storage strategies (httpOnly cookies vs localStorage) Token refresh patterns Revocation and logout Security Best Practices PKCE (Proof Key for Code Exchange) State parameter for CSRF protection Nonce for replay protection Secure token storage Short-lived access tokens Identity Providers Auth0 integration Okta configuration Keycloak self-hosted Google/GitHub/Microsoft social login SAML to OIDC bridge Dependencies Works well with: nextjs-app-router-expert - Full-stack auth implementation api-architect - API authorization design cloudflare-worker-dev - Edge authentication site-reliability-engineer - Auth monitoring Examples Authorization Code Flow with PKCE (SPA) Next.js API Route Token Handler JWT Validation (Node.js) Token Refresh Pattern Social Login Setup (Auth0) OIDC D …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills erichowens/oauth-oidc-implementer