authBuild secure authentication with sessions, JWT, OAuth, passwordless, MFA, and SSO for web and mobile apps.
Install via ClawdBot CLI:
clawdbot install ivangdavila/authGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Sends data to undocumented external endpoint (potential exfiltration)
Send → https://app.com/reset?token=<tokenCalls external URL not in known-safe list
https://clawic.com/skills/authUses known external API (expected, informational)
api.github.comAI Analysis
The skill is explicitly documented as a reference guide containing only example code and patterns, with clear disclaimers that it does not execute code, make network requests, or access credentials. The flagged external URLs are either the skill's homepage or example placeholders within instructional code snippets, not operational endpoints.
Generated Mar 1, 2026
A retail website needs secure user login with sessions and cookies for traditional web browsing, plus social login options like OAuth with Google or Facebook to reduce signup friction. It must handle password security with bcrypt and implement MFA for high-value transactions to prevent account takeover.
A financial app requires JWT-based authentication for stateless API calls, short-lived tokens for security, and refresh tokens for offline access. It should include MFA via authenticator apps to avoid SMS vulnerabilities and audit logging for compliance without storing sensitive data like passwords.
A patient portal uses SSO with OIDC for enterprise integration across clinics, ensuring centralized identity management. It enforces strict session management with secure cookies and requires re-authentication for sensitive operations like viewing medical records, following HIPAA guidelines.
A B2B software service implements JWT for scalable microservices, with rate limiting and CAPTCHA on login to prevent brute force attacks. It offers passwordless email login options and logs all authentication events except secrets to monitor for suspicious activity.
Companies charge monthly or annual fees for access to software, requiring robust authentication to protect user data and prevent unauthorized access. This model benefits from JWT for stateless scaling and social login to streamline user onboarding and retention.
Platforms facilitate transactions between buyers and sellers, relying on secure authentication to build trust and prevent fraud. Sessions with cookies enhance user experience for web shoppers, while MFA and audit logging help secure financial transactions and comply with regulations.
Firms provide specialized tools or consulting to other businesses, often using SSO for seamless integration with client systems. Authentication strategies like OIDC support centralized management, and defense-in-depth measures like rate limiting protect against attacks on sensitive corporate data.
💬 Integration Tip
Use this skill as a reference to adapt code examples into your project, ensuring to replace placeholders like SECRET with actual environment variables and implement libraries for crypto instead of custom solutions.
Scored Apr 19, 2026
Audited Apr 16, 2026 · audit v1.0
Self-hosted auth for TypeScript/Cloudflare Workers with social auth, 2FA, passkeys, organizations, RBAC, and 15+ plugins. Requires Drizzle ORM or Kysely for D1 (no direct adapter). Self-hosted alternative to Clerk/Auth.js. Use when: self-hosting auth on D1, building OAuth provider, multi-tenant SaaS, or troubleshooting D1 adapter errors, session caching, rate limits, Expo crashes, additionalFields bugs.
Clerk integration. Manage Users, Organizations. Use when the user wants to interact with Clerk data.
Clerk auth with API Keys beta (Dec 2025), Next.js 16 proxy.ts (March 2025 CVE context), API version 2025-11-10 breaking changes, clerkMiddleware() options, webhooks, production considerations (GCP outages), and component reference. Prevents 15 documented errors. Use when: API keys for users/orgs, Next.js 16 middleware filename, troubleshooting JWKS/CSRF/JWT/token-type-mismatch errors, webhook verification, user type inconsistencies, or testing with 424242 OTP.
Sentry API integration with managed authentication. Monitor errors, issues, and application performance. Use this skill when users want to list issues, retrieve events, manage projects, teams, or releases in Sentry. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Sentry connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Sentry action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Sentry examples; they add no Sentry capability - Sentry is not an event source, a trigger cannot read Sentry data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).
Host static files on subdomains with optional authentication. Use when you need to serve HTML, images, CSS, JS, or any static content on a dedicated subdomain. Supports file upload, basic auth, quota management, and automatic SSL via Caddy. Commands include sf sites (create/list/delete), sf upload (files/directories), sf files (list/delete).
Download YouTube videos by URL in various resolutions using a pay-per-use API with credit-based authentication and no charge on failed downloads.