auth-patterns
Installation
SKILL.md
Auth Patterns
Authentication = who are you? Authorization = what can you do?
1. Strategy Selection
| Strategy | Best For | Stateless? |
|---|---|---|
| Session + Cookie | Traditional web, SSR | No |
| JWT (access token) | SPAs, mobile, stateless APIs | Yes |
| JWT + Refresh Token | Long-lived sessions, mobile | Yes* |
| OAuth 2.0 (provider) | Third-party login | Yes |
| API Keys | Server-to-server, dev tools | Yes |
| Passkeys (WebAuthn) | Passwordless modern | Yes |
| mTLS | Service-to-service internal | Yes |