From grimoire
Designs and reviews OAuth 2.0/OIDC authorization flows with PKCE and OWASP best practices for web, mobile, and API systems.
How this skill is triggered — by the user, by Claude, or both
Slash command
/grimoire:design-auth-flowThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Design secure authentication and authorization flows using OAuth 2.0 / OIDC standards with PKCE and OWASP best practices.
Design secure authentication and authorization flows using OAuth 2.0 / OIDC standards with PKCE and OWASP best practices.
Adopted by: Google, Microsoft, GitHub, Okta, Auth0 — all implement OAuth 2.0 + PKCE as the baseline Impact: OWASP reports that broken authentication is consistently in the top 3 web vulnerabilities; PKCE (RFC 7636) eliminates the authorization code interception attack that affected millions of mobile apps.
Why best: Rolling custom auth is the single highest-risk decision in software security. OAuth 2.0 + OIDC provides a peer-reviewed, widely-audited framework. PKCE extends it safely to public clients (SPAs, mobile apps) where client secrets cannot be stored securely.
code_verifier (43-128 chars); hash it to code_challenge (S256); send challenge in auth request; send verifier in token exchange.iss, aud, exp, and nbf claims. Never trust unsigned tokens or skip expiry checks.PKCE flow (SPA):
code_verifier = random(64), code_challenge = base64url(sha256(verifier))./authorize?response_type=code&code_challenge=...&code_challenge_method=S256./token — server verifies sha256(verifier) == challenge.state parameter — enables CSRF attacks on the OAuth callback.npx claudepluginhub jeffreytse/grimoire --plugin grimoireImplements OAuth 2.0 authorization code + PKCE flow with security best practices: exact redirect URI matching, short-lived tokens, state parameter CSRF protection, and deprecation of implicit grant.
Configures OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. Covers flow selection, PKCE implementation, token lifecycle, and OAuth 2.1 security best practices.