# Accessible Authentication

> Reviews login, MFA, one-time codes, recovery, and reauthentication for accessible completion. Use for authentication-specific accessibility; use accessible-forms for general labeling and validation.

- Skill: `smukh/accessible-authentication` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add smukh/accessible-authentication`
- Raw SKILL.md: https://api.skillmd.com/api/skills/smukh/accessible-authentication/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- License: MIT
- Author: smukh (https://skillmd.com/u/smukh)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/smukh/accessible-authentication

---


# Accessible authentication

## Workflow

1. Map each available authentication path and its initial, invalid, expired,
   retry, and successful states. Use test accounts and synthetic codes; preserve
   the site's security policy.
2. Read [the authentication review guide](references/authentication-review.md)
   for cognitive burden, credential entry, recovery, and policy boundaries.
3. Replay whole-value paste, password-manager entry where available, keyboard
   submission, and error recovery. Record what was actually exercised rather
   than inferring support from autocomplete markup.
4. Repair the source that owns the barrier. Re-run the same path, including
   failure and retry, and add a behavioral test for the supported input
   mechanism.
5. Follow the guide's manual checks for browser/password-manager and
   screen-reader behavior; report untested combinations explicitly.

## Boundaries

General form labels and validation remain in accessible-forms. This skill owns
the complete authentication path, including challenges outside the initial form.
Do not remove MFA, weaken rate limits, change account enumeration behavior, or
invent a recovery policy. A passing clipboard test does not prove
password-manager support or WCAG conformance.