RFC 7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants. Profiles the OAuth Assertion Framework (RFC 7521) to define (1) the jwt-bearer authorization grant for requesting an access token from an existing trust relationship without a user-approval step, and (2) JWT-based client authentication at the token endpoint via client_assertion. The basis for the private_key_jwt client authentication method. Use when implementing or validating signed JWT assertions for OAuth token requests, client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer, or iss/sub/aud/exp claim validation.
OpenID Connect Discovery 1.0 - Defines mechanism for Relying Party to discover OpenID Provider and obtain OAuth 2.0 endpoint locations. Covers Issuer Discovery, Provider Metadata, and Configuration Information retrieval. Use when working with OpenID Provider discovery, well-known endpoints, or metadata configuration.
OpenID Connect Core 1.0 - Identity layer on top of OAuth 2.0 protocol. Defines ID Token, UserInfo endpoint, authentication flows (Authorization Code, Implicit, Hybrid), claims, and standard claims for identity. Use when working with OpenID Connect authentication, identity tokens, user profile information, or OAuth 2.0 extensions for identity.
RFC 6749: The OAuth 2.0 Authorization Framework. Defines the protocol for third-party application access to HTTP services on behalf of a resource owner, introducing authorization layers, access tokens, and refresh tokens. Replaces OAuth 1.0 (RFC 5849).
RFC 7636: Proof Key for Code Exchange by OAuth Public Clients. Defines PKCE extension for OAuth 2.0 Authorization Code flow, mitigating authorization code interception attacks by introducing code_verifier and code_challenge parameters. Enables secure OAuth usage for public clients like mobile apps and SPAs.
Web Authentication Level 2 (WebAuthn) - W3C specification defining an API for strong, attested, scoped public key-based credentials. Enables passwordless authentication and phishing-resistant MFA using platform or roaming authenticators. Use when working with WebAuthn API, FIDO2, public key credentials, or browser-based authentication.
Creates an Agent Skill from an RFC URL. Downloads the RFC text and creates a skeleton SKILL.md. The LLM should then read the RFC and enhance the skeleton with proper description, title, and key information. Use when you need to create a skill from an IETF RFC document.
RFC 4226 - HOTP: An HMAC-Based One-Time Password Algorithm. Defines the standard algorithm for generating one-time password values using HMAC. Use when working with HOTP, one-time passwords, HMAC-based authentication, two-factor authentication systems, or OATH standards.