メニュー
Authentication and authorization specialist covering Auth0, Clerk, and Firebase Auth. Use when implementing authentication, MFA, SSO, passkeys, WebAuthn, social login, or security features.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/TuYv/ccpm --skill moai-platform-authコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Use when auditing a paid ad account for incremental contribution, wasted spend, or measurement integrity before scaling; runs a typed 20-item ROAS profile with verified vetoes and a SHIP/FIX/BLOCK/UNDECIDED gate on own exported data. Not for campaign structure design — use campaign-architect; not for creative production — use ad-creative-builder. 付费广告账户审计/ROAS评分
Use when the user asks to "write ad copy", "generate RSA headlines", or "build ad creative at volume"; produces ad units — RSA headlines/descriptions, hooks, and an angle matrix — message-matched to the destination landing page. Not for scoring an ad account — use ad-account-auditor; not for the post-click page — use landing-optimizer; not for organic articles — use content-writer. 广告创意/广告文案/RSA标题
Use when the user asks to "design an A/B test", "set up a creative/landing test", "run an incrementality test", or "is this result statistically and practically material?"; produces a hypothesis, variant matrix, sample-size/duration/power plan, and a documented effect/uncertainty read from own exported results. It applies only a precommitted owner-approved action rule; the statistical helper never chooses a business action. Not for producing variants — use ad-creative-builder; not for reading back one shipped change — use paid-measurement-loop. 广告AB测试设计/实验设计/显著性判定/增效测试
SOC 職業分類に基づく
SKILL.md を表示中
| name | moai-platform-auth |
| description | Authentication and authorization specialist covering Auth0, Clerk, and Firebase Auth. Use when implementing authentication, MFA, SSO, passkeys, WebAuthn, social login, or security features. |
| license | Apache-2.0 |
| compatibility | Designed for Claude Code |
| allowed-tools | Read, Write, Edit, Grep, Glob, Bash(npm:*), Bash(npx:*), Bash(firebase:*), Bash(curl:*), WebFetch, WebSearch, mcp__context7__resolve-library-id, mcp__context7__get-library-docs |
| user-invocable | false |
| metadata | {"version":"2.0.0","category":"platform","status":"active","updated":"2026-02-09","modularized":"false","platforms":"Auth0, Clerk, Firebase Auth","tags":"auth0, clerk, firebase, authentication, authorization, mfa, sso, passkeys, webauthn, social-login, security","context7-libraries":"/auth0/docs, /clerk/clerk-docs, /firebase/firebase-docs","related-skills":"moai-platform-supabase, moai-platform-vercel, moai-domain-backend, moai-expert-security"} |
| progressive_disclosure | {"enabled":true,"level1_tokens":100,"level2_tokens":4500} |
| triggers | {"keywords":["auth0","clerk","firebase auth","authentication","authorization","mfa","sso","passkeys","webauthn","social login","user management","attack protection","auth ui","passwordless","oauth","identity","jwt","token security"],"agents":["expert-backend","expert-security","expert-frontend"],"phases":["run"]} |
Comprehensive authentication and authorization guidance covering three major platforms: Auth0 (enterprise security), Clerk (modern UX), and Firebase Auth (mobile-first).
Enterprise-grade identity platform focused on security compliance and attack protection.
Best For: Enterprise applications requiring strong compliance (FAPI, GDPR, HIPAA), sophisticated attack protection, token security with sender constraining (DPoP/mTLS), multi-tenant B2B SaaS.
Key Strengths: Advanced attack protection (bot detection, breached passwords, brute force), adaptive MFA, compliance certifications (ISO 27001, SOC 2, FAPI), token security (DPoP, mTLS), extensive security monitoring.
Cost Model: Priced per monthly active user with enterprise features at higher tiers.
Context7 Library: /auth0/docs
Modern authentication with beautiful pre-built UI components and WebAuthn support.
Best For: Modern web applications prioritizing developer experience and user experience, Next.js applications, applications requiring social login with minimal setup, passwordless authentication.
Key Strengths: Drop-in React components with beautiful UI, WebAuthn and passkeys support, seamless Next.js integration, organization management, simple API with excellent DX.
Cost Model: Free tier available, priced per monthly active user with generous limits.
Context7 Library: /clerk/clerk-docs
Google ecosystem authentication with seamless Firebase services integration.
Best For: Mobile applications (iOS, Android, Flutter), Google ecosystem integration, serverless Cloud Functions, applications requiring anonymous auth with upgrade path, small to medium web applications.
Key Strengths: Native mobile SDKs for iOS/Android/Flutter, Google Sign-In integration, Firebase services integration (Firestore, Storage, Cloud Functions), phone authentication, free tier with generous limits.
Cost Model: Free tier with generous limits, pay-as-you-go for higher volumes.
Context7 Library: /firebase/firebase-docs
Choose Auth0 when:
Choose Clerk when:
Choose Firebase Auth when:
These patterns apply across all three platforms with platform-specific implementations.
Session Management:
All platforms support session persistence, refresh tokens, and session invalidation. Auth0 uses refresh token rotation, Clerk uses session tokens with automatic refresh, Firebase uses ID token refresh with custom claims.
Multi-Factor Authentication:
All platforms support multiple MFA factors including TOTP, SMS, and push notifications. Auth0 provides WebAuthn and adaptive MFA, Clerk provides WebAuthn with passkeys, Firebase provides phone verification and custom MFA.
Social Authentication:
All platforms support major social providers (Google, Facebook, GitHub, Apple). Auth0 requires connection configuration per provider, Clerk provides pre-configured social login buttons, Firebase requires OAuth configuration and SDK setup.
Role-Based Access Control:
All platforms support custom claims or metadata for authorization. Auth0 uses custom claims in JWT tokens with Actions, Clerk uses organization roles and metadata, Firebase uses custom claims with Admin SDK.
Token Management:
All platforms issue JWT tokens for API authorization. Auth0 provides access tokens with scopes and refresh tokens, Clerk provides session tokens via getToken(), Firebase provides ID tokens with custom claims.
Applicable to all platforms:
Token Storage:
HTTPS Enforcement:
Token Validation:
Password Policies:
API Security:
For detailed platform-specific implementation guidance, see the reference files:
File: reference/auth0.md
Covers attack protection configuration, MFA setup with WebAuthn and adaptive policies, token security with DPoP and mTLS sender constraining, compliance features for FAPI/GDPR/HIPAA, Security Center monitoring, and continuous session protection.
Key sections: Dashboard navigation, bot detection configuration, breached password detection, brute force protection, WebAuthn setup, token validation, DPoP implementation, mTLS certificate binding, compliance certifications.
File: reference/clerk.md
Covers ClerkProvider setup for Next.js, authentication components (SignIn, SignUp, UserButton), route protection with middleware, useAuth and useUser hooks, server-side authentication, organization management, and Core 2 migration.
Key sections: Environment variables, middleware configuration, protecting routes, accessing user data, organization switching, custom authentication flows, webhook integration.
File: reference/firebase-auth.md
Covers Firebase SDK initialization across platforms (Web, Flutter, iOS, Android), social authentication setup, phone authentication with SMS verification, anonymous auth with account linking, custom claims for RBAC, and Security Rules integration.
Key sections: Project setup, SDK initialization, Google Sign-In, Facebook Login, phone verification, custom claims management, Firestore and Storage rules, Cloud Functions triggers.
File: reference/comparison.md
Provides detailed comparison matrix covering features, pricing, use cases, migration considerations, and integration complexity.
Key sections: Feature comparison table, pricing breakdown, use case decision matrix, platform migration strategies, ecosystem integration, developer experience comparison.
When working with authentication features:
Access up-to-date platform documentation using Context7 MCP:
Auth0:
Clerk:
Firebase Auth:
.claude/rules/moai/languages/typescript.md: TypeScript patterns for auth SDKs (auto-loaded via paths frontmatter)Status: Active Version: 2.0.0 (Consolidated Platform Coverage) Last Updated: 2026-02-09 Platforms: Auth0, Clerk, Firebase Auth
| Rationalization | Reality |
|---|---|
| "Password-only auth is sufficient for an internal tool" | Internal tools are compromised via credential stuffing. MFA is the minimum for any tool with access to production data. |
| "I will implement auth from scratch to avoid vendor lock-in" | Custom auth implementations are the leading source of security vulnerabilities. Use a proven provider and abstract the interface. |
| "Session expiry can be long since users dislike re-login" | Long sessions increase the attack window for stolen tokens. Use short sessions with silent refresh. |
| "Social login is just a convenience feature" | Social login delegates identity verification to identity providers. It reduces your attack surface for password storage. |
| "WebAuthn/passkeys are too new to adopt" | Passkeys are supported by all major browsers and platforms. They eliminate phishing, which is the most common attack vector. |
R4 audit verdict (2026-04-23): REFACTOR — retain triplet scope (Clerk, Auth.js, Supabase Auth) with narrower per-vendor guidance SPEC: SPEC-V3R2-WF-001 §6.2 line 272 Refactor scope (deferred to future sub-SPEC):
This skill is retained in v3.0 but its body will be restructured in a follow-up SPEC.