Implement Secure Authentication and Authorization

This skill builds secure, scalable authentication and authorization systems using industry-standard patterns. Its process: define users, tenants, flows, and threat-model constraints; choose an auth strategy (session-based, JWT, or OIDC) and token lifecycle; design the authorization model and its policy enforcement points; and plan secrets storage, rotation, logging, and audit requirements. A detailed implementation playbook (resources/implementation-playbook.md) covers deeper patterns and examples.

Use this when implementing user authentication systems, securing REST or GraphQL APIs, adding OAuth2/social login or SSO, designing session management or role-based access control (RBAC), or debugging authentication/authorization issues.

Not the right skill for UI copy or login page styling with no underlying auth logic change, for infrastructure-only work with no identity concerns, or when you can't actually change auth policies or credential storage - there's nothing to implement if the policy is fixed and out of scope.

Inputs: the system's users/tenants, required auth flows (login, SSO, OAuth2), and threat-model constraints.

Outputs: a chosen auth strategy (session, JWT, or OIDC) with defined token lifecycle, an authorization model with policy enforcement points, and a secrets storage/rotation/logging/audit plan - with the hard rule that secrets, tokens, and credentials are never logged, and least-privilege plus secure key storage are enforced throughout.

OAuth2, OIDC, JWT, session-based auth, RBAC - applies broadly across REST and GraphQL APIs independent of a specific vendor.

Backend and security engineers implementing or securing authentication/authorization systems who need a structured process from threat model through token strategy, authorization design, and secrets handling.