Agent skill · software engineering · jeremylongshore
guidewire-install-auth
Authenticate production Guidewire Cloud API integrations and survive the auth-side failures — token expiry storms, scope drift, private-CA PKIX errors, secret rotation. Use when hardening OAuth2 token caching, configuring JVM trust stores, or rotating client secrets without downtime. Trigger with "guidewire auth", "guidewire OAuth2", "guidewire token cache", "guidewire PKIX", "guidewire secret rotation".
Why this skill is useful
Adds executable scripts for managing OAuth2 token caching and secret rotation specific to Guidewire Cloud integrations.
What it needs
Requires java installed locally. Requires guidewire account access. About 7k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Guidewire Install & Auth Overview Authenticate a backend service to a Guidewire Cloud tenant using OAuth2 client credentials and operate the auth layer in production. This is not a hello-world walkthrough; it is the auth code your service runs at 3am when a token expires mid-batch, when a tenant admin rotates a scope, when a private CA renews a cert, and when on-call needs to swap a leaked secret without dropping in-flight requests. The four production failures this skill prevents: 1. Token expiry storms — every request races to refresh, the Hub rate-limits the auth endpoint, the integration cascades to red. 2. Scope drift — a GCC admin removes a scope, every cached token starts returning 403, retrying does not help. 3. PKIX path building failed — JVM cannot validate the tenant's TLS chain because the private CA is not in the trust store; common when carriers front Cloud API with their own DLP appliance. 4. Secret rotation downtime — the active client secret is rotated and the old secret stops working before the new one is loaded; in-flight token refreshes fail until restart. Prerequisites JDK 17 (Guidewire Cloud release 202503 and later) A registered Service Application in Guidewire Cloud Console (GCC) with Cloud API roles assigned per least privilege Network egress from your runtime to .guidewire.net (runtime APIs) and gcc.guidewire.com (console only) A secret store the runtime can read at startup and on rotation signal (AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault, or Kubernetes Secret with CSI driver) For private-CA tenants: the carrier's CA chain in PEM form Instructions Build the auth layer in this order. Each section solves one production failure mode; do not skip steps because the failure shows up in production, not in dev. 1. Implement the token-cache pattern below — proactive refresh, single-flight gate, JWT-based expiry. 2. Wire secret rotation to your secret store; do not commit secrets or bake them into images. 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/guidewire-install-auth--9f33e8