Implement secure API authentication across platforms

This skill turns an agent into an API authentication expert, covering the core methods used in production APIs and the code needed to implement them. It provides working patterns for API keys (header-based and query-parameter, with the source itself flagging query-parameter keys as less secure), JWT issuance and verification with expiry handling, and a full OAuth 2.0 authorization code flow including the client redirect, state parameter, and code-for-token exchange.

Beyond the core methods it covers the surrounding security practices: secure cookie configuration for refresh tokens (HttpOnly, secure, sameSite=strict), a sliding-window rate-limiting decorator, Go middleware that extracts and validates a Bearer token from the Authorization header, and a TypeScript TokenManager class that refreshes an expired access token before making an authenticated request. It also includes multi-factor authentication via TOTP (with QR-code provisioning for authenticator apps), CORS and security-header configuration using helmet, a key-rotation strategy for JWT signing that tracks key IDs (kid) to support RS256 rotation without breaking old tokens, and a structured logging pattern for auth events (failed logins, token issuance, rate-limit violations).

Use this skill when you are choosing or implementing an API's authentication layer: adding API-key auth for server-to-server calls, issuing and verifying JWTs for stateless sessions, wiring an OAuth 2.0 authorization code flow for delegated third-party access, or adding MFA and key rotation to an existing auth system. It is not a finished auth service - it is a pattern and code-snippet reference you wire into your own user store, secret management, and identity provider. Skip the query-parameter API-key variant for anything beyond quick internal testing; the pattern itself calls that option out as the less secure choice.

Input: a description of the authentication requirement (server-to-server key, stateless JWT session, delegated OAuth access, MFA enrollment, or key rotation). Output: production-oriented code in JavaScript, Python, Go, and TypeScript covering token issuance and verification, refresh-token rotation, rate limiting, CORS/security headers, TOTP-based MFA with QR provisioning, RS256 JWT key rotation keyed by kid, and structured auth-event logging.

The code samples target Express.js/Node (with the helmet and cors packages), Python (JWT encode/decode, a rate-limiting decorator, pyotp and qrcode for MFA), Go's net/http for middleware-based Bearer-token validation, and TypeScript for a browser-side token manager that handles refresh and retry.

Backend and full-stack developers implementing or hardening API authentication in Node.js, Python, Go, or TypeScript codebases - anyone who needs working code for JWT, OAuth2, MFA, or key rotation rather than a conceptual explainer of how authentication works.