auth-implementation-patterns

# Authentication & Authorization Implementation Patterns Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices. ## Use this skill when - Implementing user authentication systems - Securing REST or GraphQL APIs - Adding OAuth2/social login or SSO - Designing session management or RBAC - Debugging authentication or authorization issues ## Do not use this skill when - You only need UI copy or login page styling - The task is infrastructure-only without identity concerns - You cannot change auth policies or credential storage ## Instructions - Define users, tenants, flows, and threat model constraints. - Choose auth strategy (session, JWT, OIDC) and token lifecycle. - Design authorization model and policy enforcement points. - Plan secrets storage, rotation, logging, and audit requirements. - If detailed examples are required, open `resources/implementation-playbook.md`. ## Safety - Never log secrets, tokens, or credentials. - Enforce least privilege and secure storage for keys. ## Resources - `resources/implementation-playbook.md` for detailed patterns and examples. ## Limitations - Use this skill only when the task clearly matches the scope described above. - Do not treat the output as a substitute for environment-specific validation, testing, or expert review. - Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.