Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+21 more

    Auth System Designer

    1

    Every recommendation comes with the security reasoning, so you understand why — not just what to implement.

    $9.99

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Auth System Designer

    Auth System Designer

    Example session with this skill installed

    We're building a B2B SaaS with a React SPA and a Node/Express API, with a mobile app planned next year. Customers are companies with admins, managers and viewers, and one user can belong to several companies. Design the auth architecture.

    • Read your context and instructions
    • Compiled the auth system designer

    Auth architecture: server-side sessions for the SPA now, short-lived tokens added for mobile later, tenant-scoped RBAC on every request.

    Login and sessions

    • Email and password with an OIDC option (Google, Microsoft) for company SSO.
    • SPA: session ID in an HttpOnly; Secure; SameSite=Lax cookie, session data in Redis or Postgres.

    Session vs token

    ClientMechanismWhy
    React SPAServer session cookieInstant revocation, nothing readable by JS
    Mobile appAccess token (15 min) + refresh tokenNo cookie jar; offline-friendly
    IntegrationsScoped API keys per tenantMachine access, revocable

    RBAC model

    user ── membership(tenant_id, role) ── tenant
role: admin | manager | viewer
permission check: can(user, tenant_id, action)
    • Roles live on the membership, not the user, so one person can be admin in one company and viewer in another.
    • Handlers check permissions, not role names.

    Tenant isolation

    • Active tenant is chosen at login or by a switcher and stored in the session.
    • Every query filters on tenant_id taken from the session, never from the request body.

    Token refresh (mobile)

    • Rotate refresh tokens on each use; reusing an old one revokes the whole token family.
    • Store refresh tokens hashed, with device name, for per-device logout.

    Next steps

    • Write the permission matrix for the three roles.
    • Add a test that fails if any query runs without a tenant filter.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Auth is where one wrong early decision becomes a security incident with your name on it — JWTs chosen for sessions because a tutorial used them, refresh token rotation implemented wrong, RBAC bolted on after the fact because nobody thought about permissions on day one. This skill designs your auth system from scratch: the right session strategy for your use case, token storage and rotation that doesn't create XSS or CSRF exposure, permission model that scales beyond three user types, and the OAuth/SSO integration path if you need it. Every recommendation comes with the security reasoning, so you understand why — not just what to implement. Use it before you write your first auth endpoint. Give it your app type, your user model, and your threat surface; it returns a complete auth architecture you can implement without discovering the problems at your first security review.

    • Focuses on architecture, not boilerplate code generation.
    • Does not perform live security penetration testing.
    • Requires user input on stack for specific SDK advice.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before any payment.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 4 months ago

    Permissions

    No special permissions declared or detected

    Listed4 months ago
    Updated4 months ago

    What's inside

    Frequently Asked Questions

    This skill bridges the gap between basic requirements and secure implementation by providing specific architectural blueprints for things like JWT revocation, RBAC scaling, and multi-tenant isolation.

    The Auth System Designer is platform-agnostic; it generates language-neutral architectural specs and logic that can be implemented in any stack, from Node.js and Python to Go or Rust.

    You receive a specialized agent skill designed for use with top-tier LLMs (like GPT-4 or Claude 3), including the logic to output structured auth diagrams, flow specifications, and security checklists.

    Yes, it includes a dedicated 'Build vs. Buy' assessment capability to help you determine if a managed service like Clerk or Auth0 is more cost-effective than building a custom solution.

    Connect your AI agent to Agensi through MCP, then ask it to use Auth System Designer on your task. Your agent loads the latest approved version each time. Paid skills require a purchase or active subscription. Skill files are not available for download; your licence does not allow you to save, copy or export any part of a skill.

    While the skill focuses on architecture and logic design, it provides the necessary pseudo-code and flow logic that your development team can directly translate into production code.