SkillAtlasSkill 详情

building-api-authentication

A model-agnostic agent-skills platform.

审核状态:已审核Quality 72Security 70

复制安装命令

用 Codex 或 Claude 安装复制这段 Prompt,粘贴到 Codex、Claude 或其他助手里,让它先审查 Skill 页面再帮你安装。

复制前请先查看来源、License 和安全提示。

项目 README

来源文件:README.md

抓取于 2026年8月27日

Tons of Skills

A model-agnostic agent-skills platform. The canonical layer is harness-free by construction; Claude Code is currently the verified-native harness. Other harnesses remain engineering candidates until their native-path integration is verified; source research alone is never presented as public support.

Release CLI Plugins Skills GitHub Stars skills.sh Sponsor: Kobiton Buy me a monster

ko-fi

Version semantics: the release badge is this marketplace's display version. npm packages, including the ccpi CLI and publishable plugins, retain their own package versions; they are intentionally not expected to equal the display version. The version-surface checker governs the display surfaces without rewriting package semver.

Install

Inside Claude Code, one command installs the whole marketplace:

/plugin marketplace add jeremylongshore/claude-code-plugins

Or use the CLI:

pnpm add -g @intentsolutionsio/ccpi
ccpi install devops-automation-pack

Browse the marketplace · Explore plugins · Download bundles

Killer Skill of the Week — no-ai-slop by Peter Yang

Strip AI slop from any draft — named-pattern edits that keep the writer's real voice

no-ai-slop does two jobs and refuses to fake a third. In Edit mode it makes the minimum effective edit — cutting throat-clearing, weak verbs, and abstract nouns while deliberately preserving the writer's cadence, bluntness, humor, and honest admissions, so a rough draft still sounds like the same person afterward. In Detect mode it names each AI-slop pattern it finds, quotes the offending line, and gives the fix in a few words — and pointedly does NOT score the draft or guess whether an AI wrote it. That restraint is the whole point: AI detectors guess; named patterns are evidence the reader can check. MIT-licensed, single focused skill, actively maintained by Peter Yang.

"AI detectors guess. Named patterns are evidence the user can check." — Peter Yang

Grade: A | Week of July 22, 2026 (W30) | View on GitHub

Previous picks: tonone, mnemos, databricks-pack, kobiton-automate, skyvern, code-cleanup, web-analytics, token-optimizer, executive-assistant-skills, skill-creator, cursor-pack, crypto-portfolio-tracker. See all at tonsofskills.com.

Scale, labeled

Every number below names the cohort it counts and the command that reproduces it — an unlabeled count is how a corpus ends up with five contradictory answers to "how many skills."

CountCohortReproduce with
442catalog plugins (catalog-entry cohort)node scripts/generate-readme-toc.mjs over marketplace.extended.json
3,067marketplace-visible skills (distinct)node -e "import('./scripts/corpus-resolver.mjs').then(m=>console.log(m.resolveCorpus('marketplace-visible').length))"
347agent definitions in pluginsgit ls-files 'plugins/**' | grep '/agents/.*\.md'
19plugin categoriesls -d plugins/*/

📦 Live npm Downloads

Across 396 published packages in the claude-code-plugins namespace. Updated daily by GitHub Actions.

WindowAll packagesEstablished (>30d)
Last 24 hours962962
Last 7 days2,9202,916
Last 30 days12,86812,779

"Established" excludes packages first published within the last 30 days, so a bulk-publish event doesn't dominate the headline.

Top 10 by last 30 days:

#PackageLast 30d
1@intentsolutionsio/openrouter-pack556
2@intentsolutionsio/groq-pack496
3@intentsolutionsio/databricks-pack274
4@intentsolutionsio/clickhouse-pack273
5@intentsolutionsio/wallet-security-auditor263
6@intentsolutionsio/notion-pack258
7@intentsolutionsio/elevenlabs-pack244
8@intentsolutionsio/freshie-inventory-manager214
9@intentsolutionsio/supabase-pack210
10@intentsolutionsio/agency-os204

Last refreshed 2026-08-19T03:03:05.709Z.

Ways in

Five real questions, five doors — each resolves to a live, generated surface, never a hand-maintained list:

Browse by category

The 19 categories below link into the live marketplace. Plugin counts are the catalog-entry cohort — regenerated from marketplace.extended.json by this generator; the catalog itself lives on tonsofskills.com, never in this file (§ 6A of the platform blueprint).

CategoryPlugins
🤖AI & Machine Learning36
🎭AI Agents & Agency10
🔌API Development26
💼Business Tools6
👥Community21
₿Crypto & Web327
💾Database26
🎨Design2
🔧DevOps & Infrastructure36
📚Examples & Templates5
🧩MCP Servers16
📦Packages5
⚡Performance25
✅Productivity30
🎁SaaS Skill Packs106
🔐Security27
✨Skill Enhancers9
🧪Testing28
📁Analytics1

What the classes mean

Four artifact classes live in this repository, distinguished on sight and never blurred — provenance is a truth requirement here, not a UX nicety:

ClassWhat it isHow the reader can tell
Canonical skillFirst-party, harness-free, the source of truthNo .source.json in its plugin directory
Generated adapterA thin, machine-produced harness projectionLives under a generated path with a "generated — do not edit" header
First-party packageAn Intent Solutions distribution (npm, cowork zip)@intentsolutionsio scope, IS-authored license
Upstream mirrorSomebody else's work, hosted mirror-by-default.source.json present — upstream author, license, and pinned commit recorded

Certification

Not yet certified. The certification program (tiers T0–T4 with retained, hash-matched evidence) is a later epic of the platform blueprint; until its report exists, no artifact on this surface claims a tier. This line is rendered from the absence of certification-report.json — honestly, not cosmetically.

Contribute

Start with the contribution guide, then the intake and review standards every submission passes through:

Governance

Provenance

External plugins are hosted mirror-by-default: the contributor's repository stays the source of truth, every mirrored source is pinned in a content lockfile, and upstream credit — author, license, resolved commit — is recorded in the mirror itself. Improvements flow by upstreaming to the author's repository, never by silently editing the mirror. The full decision record is the external-sync model.

License

MIT for the repository scaffolding and first-party tooling; each plugin carries its own license in its manifest, and mirrored plugins keep their upstream license verbatim.

其他

中风险

  • 来源需自行核对维护者身份。
  • 包含脚本或命令调用,安装前请复核。
  • 可能需要外部 token、网络权限或第三方服务。
  • 未检测到高风险命令。
  • 扫描发现:2 条。

Codex — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库:git clone https://github.com/jeremylongshore/tons-of-skills-marketplace.git
  3. 将 "skills/.curated/building-api-authentication" 文件夹复制到 Codex 的 skills 目录中。
  4. 重启 Codex 让新的 skill 生效。

Codex — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Codex 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Codex 让新的 skill 生效。

Claude Code — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库:git clone https://github.com/jeremylongshore/tons-of-skills-marketplace.git
  3. 将 "skills/.curated/building-api-authentication" 文件夹复制到 Claude Code 的 skills 目录中。
  4. 重启 Claude Code 让新的 skill 生效。

Claude Code — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Claude Code 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Claude Code 让新的 skill 生效。

Cursor — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库:git clone https://github.com/jeremylongshore/tons-of-skills-marketplace.git
  3. 将 "skills/.curated/building-api-authentication" 文件夹复制到 Cursor 的 skills 目录中。
  4. 重启 Cursor 让新的 skill 生效。

Cursor — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Cursor 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Cursor 让新的 skill 生效。

GitHub Copilot — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库:git clone https://github.com/jeremylongshore/tons-of-skills-marketplace.git
  3. 将 "skills/.curated/building-api-authentication" 文件夹复制到 GitHub Copilot 的 skills 目录中。
  4. 重启 GitHub Copilot 让新的 skill 生效。

GitHub Copilot — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 GitHub Copilot 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 GitHub Copilot 让新的 skill 生效。

Windsurf — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库:git clone https://github.com/jeremylongshore/tons-of-skills-marketplace.git
  3. 将 "skills/.curated/building-api-authentication" 文件夹复制到 Windsurf 的 skills 目录中。
  4. 重启 Windsurf 让新的 skill 生效。

Windsurf — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Windsurf 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Windsurf 让新的 skill 生效。
查看 SKILL.md 原文
name: building-api-authentication
description: 'Build secure API authentication systems with OAuth2, JWT, API keys,
  and session management.

  Use when implementing secure authentication flows.

  Trigger with phrases like "build authentication", "add API auth", or "secure the
  API".

  '
allowed-tools: Read, Write, Edit, Grep, Glob, Bash(api:auth-*)
version: 1.23.0
author: Jeremy Longshore <jeremy@intentsolutions.io>
license: MIT
tags:
- api
- authentication
- api-authentication
compatibility: Designed for Claude Code

Building API Authentication

Overview

Build secure API authentication systems supporting JWT Bearer tokens, OAuth 2.0 authorization code and client credentials flows, API key management, and session-based authentication. Implement token issuance, validation, refresh rotation, revocation, and role-based access control (RBAC) with scoped permissions across all API endpoints.

Prerequisites

  • Cryptographic library: jsonwebtoken (Node.js), PyJWT (Python), or jjwt (Java)
  • Secure secret storage: environment variables, AWS Secrets Manager, or HashiCorp Vault for JWT signing keys
  • Database table for user credentials, refresh tokens, and API key storage
  • Bcrypt or Argon2 for password hashing (never store plaintext passwords)
  • OAuth 2.0 provider credentials for third-party auth integration (Google, GitHub, Auth0)

Instructions

  1. Examine existing authentication setup using Grep and Read, identifying current auth mechanisms, middleware placement, and any endpoints bypassing authentication.
  2. Implement JWT token issuance on successful login: sign with RS256 (asymmetric) or HS256 (symmetric), including sub (user ID), iat, exp (15-minute access token), roles, and scopes in the payload.
  3. Create authentication middleware that extracts the Bearer token from the Authorization header, verifies the signature and expiration, and injects the decoded user context into the request object.
  4. Implement refresh token rotation: issue a long-lived refresh token (30 days) alongside the access token, store a hash of the refresh token in the database, and rotate on each refresh (invalidating the previous token).
  5. Build role-based access control (RBAC) middleware that checks user.roles against endpoint-required roles, supporting both role-level (admin, user) and scope-level (read:users, write:orders) authorization.
  6. Add API key authentication as an alternative to JWT for machine-to-machine communication: generate cryptographically random keys, store hashed values, and validate against the X-API-Key header.
  7. Implement OAuth 2.0 client credentials flow for service-to-service authentication, with token caching and automatic renewal before expiration.
  8. Add brute-force protection on login endpoints: rate limit to 5 attempts per minute per IP, implement progressive lockout (15 min, 1 hour) after repeated failures, and log all authentication attempts.
  9. Write security tests covering: valid/invalid/expired tokens, refresh token rotation, role enforcement, API key validation, brute-force lockout, and token revocation.

See ${CLAUDE_SKILL_DIR}/references/implementation.md for the full implementation guide.

Output

  • ${CLAUDE_SKILL_DIR}/src/auth/jwt.js - JWT token issuance, verification, and refresh logic
  • ${CLAUDE_SKILL_DIR}/src/auth/middleware.js - Bearer token authentication middleware
  • ${CLAUDE_SKILL_DIR}/src/auth/rbac.js - Role-based and scope-based access control middleware
  • ${CLAUDE_SKILL_DIR}/src/auth/api-keys.js - API key generation, hashing, and validation
  • ${CLAUDE_SKILL_DIR}/src/auth/oauth.js - OAuth 2.0 flow implementations
  • ${CLAUDE_SKILL_DIR}/src/routes/auth.js - Login, register, refresh, and logout endpoints
  • ${CLAUDE_SKILL_DIR}/tests/auth/ - Authentication and authorization security tests

Error Handling

ErrorCauseSolution
401 Token ExpiredJWT exp claim is in the pastClient should attempt token refresh; if refresh fails, redirect to login
401 Invalid SignatureJWT signed with different key or tampered payloadVerify signing key matches between issuance and validation; check for key rotation issues
403 Insufficient ScopeAuthenticated user lacks required role/scope for endpointReturn required scope in error body; log authorization failure with user and endpoint details
Refresh token reusePreviously rotated refresh token used (possible token theft)Invalidate all user sessions immediately; alert user of potential compromise; require re-authentication
API key leakedAPI key exposed in client-side code, logs, or version controlRevoke compromised key immediately; issue replacement; scan for exposure source

Refer to ${CLAUDE_SKILL_DIR}/references/errors.md for comprehensive error patterns.

Examples

JWT with refresh rotation: Login returns {accessToken (15min), refreshToken (30d)}; client stores refresh token securely; on 401, client calls POST /auth/refresh with old refresh token, receives new pair, old refresh token is invalidated.

Multi-provider OAuth: Support "Sign in with Google" and "Sign in with GitHub" using OAuth 2.0 authorization code flow, creating local user accounts on first sign-in and linking subsequent provider connections.

API key with scoped permissions: Generate API keys with specific scopes (read:analytics, write:webhooks), stored as SHA-256 hashes, displayed to the user only once at creation, with key rotation support.

See ${CLAUDE_SKILL_DIR}/references/examples.md for additional examples.

Resources

发现问题?提交给管理员复核

评分:

评论 (0)

暂无评论,成为第一个评论者吧!