How do I install the Backstage Auth skill?

Run npx skillmds@latest add paulasilvatech/backstage-auth-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Backstage Auth safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Backstage Auth?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Backstage Auth free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Backstage Auth?

paulasilvatech (@paulasilvatech) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Backstage Auth by paulasilvatech — Agent Skill

Name: Backstage Auth
Author: paulasilvatech

File contents

Backstage Authentication and Authorization

Conventions

Derive user identity from a validated Backstage auth context, never from request bodies or untrusted headers.
Keep sign-in identity resolution separate from delegated access to GitHub, Azure, or other providers.
Require explicit, deterministic ownership or group resolution; ambiguous matches must fail without silently choosing a user.
Authenticate backend-to-backend calls with service credentials and validate issuer, audience, expiry, and approved caller.
Apply permission checks at backend resource and action boundaries; hiding a frontend control is not authorization.
Keep guest access local-only and visibly isolated from production overlays.
Resolve client secrets and signing material from environment-backed secret stores, not source or frontend-visible config.
Return generic authentication errors externally while retaining redacted correlation evidence internally.

Verification

Tests cover valid sign-in, unresolved identity, wrong audience, expired credentials, and denied permissions.
Production configuration has no guest fallback or literal credential.
Trusted actor and trusted service identities remain distinct throughout requests.

Do / Do Not

Do	Do not
Validate identity and authorization independently at backend boundaries.	Trust request identity fields, hidden UI, or a successful sign-in as authorization.
Keep secrets external and errors safely redacted.	Put credentials in source, browser configuration, or user-visible errors.

Checklist Before Opening a PR

The change matches this instruction's applyTo scope.
Actor, service, delegated-provider, and permission identities remain distinct.
Valid, unresolved, expired, wrong-audience, and denied cases are tested.
Production configuration contains no guest fallback or literal credential.
No unrelated edits or unresolved placeholders remain.

---name: backstage-auth-2description: Use when editing Backstage sign-in, identity resolution, service authentication, or permission boundaries.---# Backstage Authentication and Authorization## Conventions- Derive user identity from a validated Backstage auth context, never from request bodies or untrusted headers.- Keep sign-in identity resolution separate from delegated access to GitHub, Azure, or other providers.- Require explicit, deterministic ownership or group resolution; ambiguous matches must fail without silently choosing a user.- Authenticate backend-to-backend calls with service credentials and validate issuer, audience, expiry, and approved caller.- Apply permission checks at backend resource and action boundaries; hiding a frontend control is not authorization.- Keep guest access local-only and visibly isolated from production overlays.- Resolve client secrets and signing material from environment-backed secret stores, not source or frontend-visible config.- Return generic authentication errors externally while retaining redacted correlation evidence internally.## Verification- Tests cover valid sign-in, unresolved identity, wrong audience, expired credentials, and denied permissions.- Production configuration has no guest fallback or literal credential.- Trusted actor and trusted service identities remain distinct throughout requests.## Do / Do Not| Do | Do not || --- | --- || Validate identity and authorization independently at backend boundaries. | Trust request identity fields, hidden UI, or a successful sign-in as authorization. || Keep secrets external and errors safely redacted. | Put credentials in source, browser configuration, or user-visible errors. |## Checklist Before Opening a PR- [ ] The change matches this instruction's `applyTo` scope.- [ ] Actor, service, delegated-provider, and permission identities remain distinct.- [ ] Valid, unresolved, expired, wrong-audience, and denied cases are tested.- [ ] Production configuration contains no guest fallback or literal credential.- [ ] No unrelated edits or unresolved placeholders remain.

Frequently asked questions

Backstage Auth