Agent skill · security · mcollina
oauth
Implements OAuth 2.0/2.1 authorization flows in Fastify applications — configures authorization code with PKCE, client credentials, device flow, refresh token rotation, JWT validation, and token introspection/revocation endpoints. Use when setting up authentication, authorization, login flows, access tokens, API security, or securing Fastify routes with OAuth; also applies when troubleshooting token validation errors, mismatched redirect URIs, CSRF issues, scope problems, or RFC 6749/6750/7636/8252/8628 compliance questions.
Why this skill is useful
Provides specific implementation patterns and validation techniques for OAuth 2.0/2.1 flows in Fastify applications that the AI wouldn't reliably generate on its own.
What it needs
Requires @fastify/cookie, @fastify/oauth2, @fastify/session, fastify-plugin installed locally. About 3k tokens when loaded. Last updated 2026-08-03. 1,894 stars on the source repository.
What this skill does
When to use Use this skill when you need to: Implement or debug an OAuth 2.0/2.1 flow in a Fastify application Validate tokens, configure PKCE, or set up refresh token rotation Secure Fastify routes and plugins with access-control middleware Resolve RFC compliance questions or identify security anti-patterns --- Step-by-step: Authorization Code + PKCE in Fastify 1. Install dependencies 2. Register the OAuth plugin Validation checkpoint: Confirm callbackUri exactly matches a registered redirect URI at the authorization server before proceeding (RFC 6749 §3.1.2). 3. Handle the callback and exchange the code 4. JWT validation middleware (token introspection hook) Validation checkpoints: Verify exp, iss, aud, and sub on every request — never skip (RFC 7519 §4) Use fastify.jwt.verify (asymmetric RS256/ES256) rather than HS256 for tokens issued by a third-party server 5. Protecting routes 6. Refresh token rotation --- Security checklist Requirement RFC reference --- --- Validate redirect URI against allowlist RFC 6749 §3.1.2 PKCE (S256) for all public clients RFC 7636 §4.2 Validate state to prevent CSRF RFC 6749 §10.12 Validate iss, aud, exp on every JWT RFC 7519 §4 Rotate refresh tokens on every use RFC 6749 §10.4 Use HTTPS everywhere; reject HTTP redirect URIs RFC 6749 §3.1.2.1 Rate-limit token endpoints OAuth 2.1 §7 --- Common anti-patterns Storing tokens in localStorage — use HttpOnly, Secure, SameSite=Strict cookies instead Skipping audience validation — allows token reuse across services Using implicit flow — deprecated in OAuth 2.1; use authorization code + PKCE Accepting responsetype=token in browser apps — tokens in URL fragments leak in logs/referrers Symmetric signing (HS256) for third-party tokens — use RS256/ES256 with JWKS endpoint --- Further implementation references See DEVICEFLOW.md for device authorization flow (RFC 8628) implementation See TOKENVALIDATION.md for JWKS rotation, caching strategies, and opaque token introspection See CLIENTCREDENTIALS.md …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills mcollina/oauth