reauth

RFC 7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants. Profiles the OAuth Assertion Framework (RFC 7521) to define (1) the jwt-bearer authorization grant for requesting an access token from an existing trust relationship without a user-approval step, and (2) JWT-based client authentication at the token endpoint via client_assertion. The basis for the private_key_jwt client authentication method. Use when implementing or validating signed JWT assertions for OAuth token requests, client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer, or iss/sub/aud/exp claim validation.

OpenID Connect Discovery 1.0 - Defines mechanism for Relying Party to discover OpenID Provider and obtain OAuth 2.0 endpoint locations. Covers Issuer Discovery, Provider Metadata, and Configuration Information retrieval. Use when working with OpenID Provider discovery, well-known endpoints, or metadata configuration.

OpenID Connect Core 1.0 - Identity layer on top of OAuth 2.0 protocol. Defines ID Token, UserInfo endpoint, authentication flows (Authorization Code, Implicit, Hybrid), claims, and standard claims for identity. Use when working with OpenID Connect authentication, identity tokens, user profile information, or OAuth 2.0 extensions for identity.

RFC 6749: The OAuth 2.0 Authorization Framework. Defines the protocol for third-party application access to HTTP services on behalf of a resource owner, introducing authorization layers, access tokens, and refresh tokens. Replaces OAuth 1.0 (RFC 5849).

RFC 7636: Proof Key for Code Exchange by OAuth Public Clients. Defines PKCE extension for OAuth 2.0 Authorization Code flow, mitigating authorization code interception attacks by introducing code_verifier and code_challenge parameters. Enables secure OAuth usage for public clients like mobile apps and SPAs.

Web Authentication Level 2 (WebAuthn) - W3C specification defining an API for strong, attested, scoped public key-based credentials. Enables passwordless authentication and phishing-resistant MFA using platform or roaming authenticators. Use when working with WebAuthn API, FIDO2, public key credentials, or browser-based authentication.

Creates an Agent Skill from an RFC URL. Downloads the RFC text and creates a skeleton SKILL.md. The LLM should then read the RFC and enhance the skeleton with proper description, title, and key information. Use when you need to create a skill from an IETF RFC document.

RFC 4226 - HOTP: An HMAC-Based One-Time Password Algorithm. Defines the standard algorithm for generating one-time password values using HMAC. Use when working with HOTP, one-time passwords, HMAC-based authentication, two-factor authentication systems, or OATH standards.

RFC 6238 - TOTP: Time-Based One-Time Password Algorithm. Extends HOTP (RFC 4226) by using time as the moving factor instead of a counter, enabling time-synchronized OTP generation. Use when working with TOTP, time-based authentication, Google Authenticator, or OATH time-based standards.

RFC 8176 - Authentication Method Reference Values. Establishes IANA registry for amr claim values in JWT tokens, defining standard identifiers for authentication methods including biometrics (face, fingerprint, iris, retina, voice), password, OTP, MFA, smart card, SMS, and more. Use when working with JWT amr claims, authentication method identifiers, or OpenID Connect authentication context.

Comprehensive OWASP Cheat Sheet Series skill providing direct access to all OWASP cheat sheets for web application security, secure coding practices, and vulnerability prevention. Use when working on authentication, authorization, injection prevention, cryptography, or any OWASP-related security guidance.

Provides clear definitions of core authentication and security terms such as identity, principal, subject, authentication, authorization, and common attack vectors. Use when clarifying terminology in authentication, security, or access control contexts.