Implement secure API authentication across platforms

API Authentication Expert Agent covers designing, implementing, and securing API authentication: API keys for server-to-server calls, JWT (stateless tokens with expiry), OAuth 2.0 authorization code flow for third-party delegated access, and multi-factor authentication via TOTP - plus the security practices and infrastructure around them, including token storage and rotation, rate limiting, CORS and security headers, key rotation, and auth-event logging.

Use it when implementing new API authentication or auditing an existing setup for gaps - for example confirming that tokens only ever travel over HTTPS, never a bare HTTP connection, before wiring in JWT or OAuth 2.0. It is not a general web-security or infrastructure-hardening agent - its scope is authentication and the security practices directly tied to it, not broader concerns like input validation or database security.

Input is the authentication method needed and the target language or framework. Output is working code across several stacks: a JavaScript fetch call with a header-based (or less-secure query-parameter) API key; Python functions to create and verify a JWT with an expiry claim; a JavaScript OAuth 2.0 authorization-code flow that builds the authorize URL and then exchanges the code for a token with client credentials; a secure HttpOnly/SameSite refresh-token cookie configuration; a Python Flask rate-limiting decorator; a Go authentication middleware that strips the Bearer prefix and validates a JWT; a TypeScript TokenManager class that refreshes an access token before it expires and attaches it to outgoing requests; Python TOTP-based MFA setup with QR-code provisioning; Express.js helmet/cors security configuration with a content-security-policy restricting script sources and a configurable allowed-origins list; a KeyRotationManager that signs and verifies JWTs against a rotating key ID (kid) using RS256; and a structured auth-event logger that records the timestamp, event type, user ID, IP address, and details for failed logins, token issuance, rate-limit violations, and suspicious access patterns.

Spans JavaScript/Node (Express, helmet, cors), Python (jwt, Flask, pyotp, qrcode), Go (net/http middleware), and TypeScript, with OAuth 2.0 authorization-code flow against a third-party auth provider:

res.cookie('refreshToken', refreshToken, {
  httpOnly: true,
  secure: process.env.NODE_ENV === 'production',
  sameSite: 'strict',
  maxAge: 7 * 24 * 60 * 60 * 1000 // 7 days
});

Backend and full-stack engineers implementing or auditing API authentication who need production-grade patterns - short-lived access tokens (15 to 60 minutes) with securely stored, rotated refresh tokens over HTTPS, rate limiting to blunt abuse, CORS and security headers, MFA for sensitive accounts, and logging that captures every authentication event for later investigation.