Implement Auth

Use this skill to implement, harden, and audit production-grade authentication, session lifecycles, token rotation, and multi-tenant security boundaries.

When to Use

• implementing OAuth2 Authorization Code flows with PKCE (RFC 7636 / OAuth 2.1)
• configuring session lifecycle with sliding expiration, absolute timeout, and multi-device management
• designing stateless access tokens paired with Refresh Token Rotation (RTR) and Redis JTI revocation lists
• establishing Row-Level Security (RLS) defense-in-depth on PostgreSQL databases
• eliminating state bleed and tenant context leakage in persistent workers (FrankenPHP, Octane, Python ASGI)
• remediating authentication vulnerabilities, token reuse attacks, or missing tenant isolation

Core Rules