Oauth2

OAuth 2.0 Skill

The industry-standard protocol for authorization.

Ecosystem Graph Preview

graph LR
  oauth2["oauth2"]:::core
  classDef core fill:#f9f,stroke:#333,stroke-width:4px;
  jwt -- "works well with" --> oauth2
  oauth2 -- "extended by" --> openid-connect
  oauth2 -- "works well with" --> jwt
  oauth2 -- "implemented by" --> clerk
  oauth2 -- "implemented by" --> better-auth
  openid-connect -- "depends on" --> oauth2

Recommended Next Skills

• jwt (Score: 0.92) Why: Direct relationship, Both are Authentication, Shared ecosystem (security), Can deploy to any, Similar network profile
• openid-connect (Score: 0.92) Why: Direct relationship, Both are Authentication, Shared ecosystem (security), Can deploy to any, Similar network profile
• better-auth (Score: 0.72) Why: Direct relationship, Both are Authentication, Similar network profile

Quick Start

OAuth 2.0 is an authorization framework that allows a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner or by allowing the third-party application to obtain access on its own behalf.

Production Patterns

Authorization Code Flow with PKCE

For single-page apps (React/Vue) and mobile apps, never use the Implicit Flow. Always use the Authorization Code Flow with PKCE (Proof Key for Code Exchange) to prevent authorization code interception attacks.

Architecture & Scaling

Scopes

Design your scopes to be granular (read:users, write:orders). When requesting access from a user, request the absolute minimum permissions necessary to function.

Error Recovery

If an access token expires (HTTP 401), automatically trigger the Refresh Token flow silently in the background, update the token, and retry the original HTTP request without forcing the user to log in again.

Security Notes

Never store the Client Secret in a frontend application or mobile app. State parameters must be cryptographically secure random strings to prevent CSRF attacks during the OAuth redirect.

References

• OAuth.net

Why use this skill

Use this when your agent works with oauth2 — structured patterns beat pasted docs and prevent common hallucinations.

AI pitfalls

• Using outdated SDK or API versions from training data
• Inventing environment variable names
• Omitting error handling and retry logic

Production checklist

• Secrets in environment variables, not source code
• Error handling and logging in place
• Rate limits and timeouts configured

Related skills

• openid-connect — extended by
• jwt — works well with
• clerk — implemented by
• better-auth — implemented by

Last Verified: 2026-07-02