About This Skill

Auth is where one wrong early decision becomes a security incident with your name on it — JWTs chosen for sessions because a tutorial used them, refresh token rotation implemented wrong, RBAC bolted on after the fact because nobody thought about permissions on day one. This skill designs your auth system from scratch: the right session strategy for your use case, token storage and rotation that doesn't create XSS or CSRF exposure, permission model that scales beyond three user types, and the OAuth/SSO integration path if you need it. Every recommendation comes with the security reasoning, so you understand why — not just what to implement. Use it before you write your first auth endpoint. Give it your app type, your user model, and your threat surface; it returns a complete auth architecture you can implement without discovering the problems at your first security review.