AiSkillz

AiSkillz is in preview: browse the catalogue now - skill downloads and subscriptions open soon.

← Back to skills
backendDownloadAny / model-agnosticLicense: My own work (all rights reserved)

Authentication & account flows

Created by CodeCraft LLC

Design, build, and review authentication and account flows independent of provider (Supabase Auth, Auth.js, Clerk, Firebase, ASP.NET Iden...

Product and technology names are trademarks of their respective owners, used only to identify what this skill covers. CodeCraft LLC is not affiliated with or endorsed by them.

by Jace (@jamick)v1.2.0 · updated 2026-10-16Report copyright infringement

Description

Design, build, and review authentication and account flows independent of provider (Supabase Auth, Auth.js, Clerk, Firebase, ASP.NET Identity, custom) — OAuth 2.x/OIDC with PKCE and state/nonce, redirect URI allow-lists, social login and Sign in with Apple requirements, magic links and OTP, password policies and reset flows, session management (cookies, refresh-token rotation, revocation), MFA and passkeys/WebAuthn, account linking, email verification, account deletion (required by app stores), mobile auth (system browser sessions, universal/app links), and rate limiting/enumeration defenses. Use whenever the user builds or reviews login, signup, logout, password reset, OAuth callbacks, sessions, MFA, passkeys, or account deletion on web or mobile.

#backend#auth#flows

Included with all-access

$9.00 value as a single download

AiSkillz is in preview: browse the catalogue now - skill downloads and subscriptions open soon.

All skills are included with the all-access subscription

Changelog

v1.2.0Oct 16, 2026Latest

Added

  • references/token-and-session-architecture.md: token and session architecture (sessions vs JWTs, refresh rotation with reuse detection, PKCE, TOTP MFA) - merged from the former auth-architecture skill.
v1.1.0Oct 3, 2026

Changed

  • Checked against the official documentation (October 2026).
  • Added that SMS/phone OTP is a restricted authenticator, that a phishing-resistant option (passkeys) is expected, and baseline session lifetimes (24 hours overall, 1 hour idle).
  • Updated 2 review checklist items and added 1.

Fixed

  • Corrected password length guidance to NIST SP 800-63B-4: at least 15 characters when the password is the only factor (8 only with MFA), at least 64 allowed, blocklist checks, no composition rules or forced rotation.
v1.0.1Oct 3, 2026

Changed

  • Added a trademark notice to the README.
v1.0.0Oct 2, 2026

Added

  • First release.