Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
GitHub Copilot
Gemini CLI+20 moreClaude CodeCursorCodex CLIGitHub CopilotGemini CLI
OpenClaw
Manus
Grok+17 agentsAuth System Designer
Every recommendation comes with the security reasoning, so you understand why — not just what to implement.
$9.99
Auth System Designer
Example session with this skill installed
We're building a B2B SaaS with a React SPA and a Node/Express API, with a mobile app planned next year. Customers are companies with admins, managers and viewers, and one user can belong to several companies. Design the auth architecture.
- Read your context and instructions
- Compiled the auth system designer
Auth architecture: server-side sessions for the SPA now, short-lived tokens added for mobile later, tenant-scoped RBAC on every request.
Login and sessions
- Email and password with an OIDC option (Google, Microsoft) for company SSO.
- SPA: session ID in an
HttpOnly; Secure; SameSite=Laxcookie, session data in Redis or Postgres.
Session vs token
| Client | Mechanism | Why |
|---|---|---|
| React SPA | Server session cookie | Instant revocation, nothing readable by JS |
| Mobile app | Access token (15 min) + refresh token | No cookie jar; offline-friendly |
| Integrations | Scoped API keys per tenant | Machine access, revocable |
RBAC model
user ── membership(tenant_id, role) ── tenant
role: admin | manager | viewer
permission check: can(user, tenant_id, action)
- Roles live on the membership, not the user, so one person can be admin in one company and viewer in another.
- Handlers check permissions, not role names.
Tenant isolation
- Active tenant is chosen at login or by a switcher and stored in the session.
- Every query filters on
tenant_idtaken from the session, never from the request body.
Token refresh (mobile)
- Rotate refresh tokens on each use; reusing an old one revokes the whole token family.
- Store refresh tokens hashed, with device name, for per-device logout.
Next steps
- Write the permission matrix for the three roles.
- Add a test that fails if any query runs without a tenant filter.
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
Auth is where one wrong early decision becomes a security incident with your name on it — JWTs chosen for sessions because a tutorial used them, refresh token rotation implemented wrong, RBAC bolted on after the fact because nobody thought about permissions on day one. This skill designs your auth system from scratch: the right session strategy for your use case, token storage and rotation that doesn't create XSS or CSRF exposure, permission model that scales beyond three user types, and the OAuth/SSO integration path if you need it. Every recommendation comes with the security reasoning, so you understand why — not just what to implement. Use it before you write your first auth endpoint. Give it your app type, your user model, and your threat surface; it returns a complete auth architecture you can implement without discovering the problems at your first security review.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 3 months ago
- Passed all security checks, Safe to install