jwtImplement secure JWT authentication with proper validation and token handling.
Install via ClawdBot CLI:
clawdbot install ivangdavila/jwtGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Generated Mar 20, 2026
A web app uses JWT for user login and session management. Access tokens are stored in memory or localStorage for API calls, with refresh tokens secured in httpOnly cookies to balance security and usability. This scenario is common in modern SPAs built with frameworks like React or Angular.
In a distributed microservices architecture, JWT with RS256 algorithm secures inter-service communication. Each service validates tokens using a shared public key from a JWKS endpoint, ensuring trust without sharing secrets. This prevents token confusion attacks across services.
A mobile app implements JWT for user authentication, with short-lived access tokens and long-lived refresh tokens stored securely on the device. The app handles token rotation and validation to protect against theft, common in e-commerce or social media apps.
IoT devices use JWT to authenticate with cloud services, with tokens containing claims like device ID and permissions. Tokens have short expirations to limit damage if compromised, and key rotation is managed via a central server for scalability.
A company exposes APIs to partners using JWT for authentication, with tokens issued by a trusted issuer and validated for specific audiences. This ensures secure data sharing while preventing unauthorized access, typical in healthcare or logistics industries.
Offer JWT authentication as part of a cloud service platform, charging monthly or annual fees based on user count or API calls. This model provides recurring revenue and scales with customer growth, appealing to startups and enterprises.
Provide expert consulting to integrate JWT into client systems, including security audits, custom middleware development, and training. Revenue comes from project-based fees or hourly rates, targeting industries with strict compliance needs.
Develop and maintain open-source JWT libraries (e.g., for Node.js or Python) while offering premium support, advanced features, or enterprise licenses. This model builds community trust and generates revenue from large organizations.
💬 Integration Tip
Always use established libraries like jsonwebtoken for Node.js and validate tokens early in middleware to prevent security breaches before business logic execution.
Scored Apr 22, 2026
Self-hosted auth for TypeScript/Cloudflare Workers with social auth, 2FA, passkeys, organizations, RBAC, and 15+ plugins. Requires Drizzle ORM or Kysely for D1 (no direct adapter). Self-hosted alternative to Clerk/Auth.js. Use when: self-hosting auth on D1, building OAuth provider, multi-tenant SaaS, or troubleshooting D1 adapter errors, session caching, rate limits, Expo crashes, additionalFields bugs.
Clerk integration. Manage Users, Organizations. Use when the user wants to interact with Clerk data.
Clerk auth with API Keys beta (Dec 2025), Next.js 16 proxy.ts (March 2025 CVE context), API version 2025-11-10 breaking changes, clerkMiddleware() options, webhooks, production considerations (GCP outages), and component reference. Prevents 15 documented errors. Use when: API keys for users/orgs, Next.js 16 middleware filename, troubleshooting JWKS/CSRF/JWT/token-type-mismatch errors, webhook verification, user type inconsistencies, or testing with 424242 OTP.
Sentry API integration with managed authentication. Monitor errors, issues, and application performance. Use this skill when users want to list issues, retrieve events, manage projects, teams, or releases in Sentry. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Sentry connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Sentry action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Sentry examples; they add no Sentry capability - Sentry is not an event source, a trigger cannot read Sentry data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).
Download YouTube videos by URL in various resolutions using a pay-per-use API with credit-based authentication and no charge on failed downloads.
OneNote API integration with managed OAuth via Microsoft Graph. Access notebooks, sections, section groups, and pages. Use this skill when users want to create or manage OneNote notebooks, organize notes, or work with page content. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn an OneNote connection into automation, in the order they are used: the connection (the first step), a hosted function that runs an OneNote action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with OneNote examples; they add no OneNote capability - OneNote is not an event source, a trigger cannot read OneNote data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).