OAuth skill for Claude Code: OAuth 2.0 and 2.1 flows in Fastify

Source: mcollina/skills · Maintainer: community: Matteo Collina · License: MIT · Checked: 24 October 2026

What is the OAuth skill?

The oauth skill is an Agent Skill that helps Claude Code, Codex, Cursor and other agents implement OAuth 2.0 and 2.1 login and API protection in a Fastify app: authorization code with PKCE, state checks, JWT validation, protected routes and refresh tokens, plus a checklist tied to the OAuth RFCs.

It is part of mcollina/skills, Matteo Collina's MIT-licensed collection, next to his Fastify skill and Node.js skill. The README summarizes it as an "OAuth 2.0/2.1 specification expert with deep RFC knowledge and Fastify integration patterns."

The SKILL.md description ends with its triggers: "Use when setting up authentication, authorization, login flows, access tokens, API security, or securing Fastify routes with OAuth; also applies when troubleshooting token validation errors, mismatched redirect URIs, CSRF issues, scope problems, or RFC 6749/6750/7636/8252/8628 compliance questions."

As of 24 October 2026, its skills.sh page listed 1.3K installs (snapshot, 24 October 2026).

What does it do?

The SKILL.md is a single file with a six-step walkthrough, a checklist and a list of anti-patterns. The folder holds only SKILL.md and a tile.json manifest.

Step by step: authorization code with PKCE in Fastify.

1. Install @fastify/oauth2, @fastify/cookie, @fastify/session and fastify-plugin.
2. Register the OAuth plugin with pkce: 'S256', a login redirect path, a callback URI, and functions that generate and check a state value stored in the session. A checkpoint tells the agent to confirm the callback URI exactly matches one registered at the authorization server.
3. Handle the callback: exchange the code for tokens, store only what you need in the session, and never log the raw token.
4. Validate JWTs on each request with @fastify/jwt, checking exp, iss and aud, and prefer asymmetric RS256 or ES256 over HS256 for tokens issued by a third party.
5. Protect a group of routes with an onRequest hook.
6. Refresh access tokens and replace the stored refresh token when the server rotates it.

Security checklist. A table maps each requirement to a reference:

Anti-patterns. Tokens in localStorage, skipped audience checks, the implicit flow, response_type=token in browser apps, and HS256 for third-party tokens. The skill recommends HttpOnly, Secure, SameSite=Strict cookies instead of browser storage.

The RFCs it cites are on the RFC Editor site: RFC 6749 (the OAuth 2.0 framework), RFC 7636 (PKCE), RFC 6750 (bearer tokens), RFC 7519 (JWT), RFC 8252 (native apps) and RFC 8628 (device authorization grant).

How do you install the OAuth skill?

The repo README lists Collina's skills without install steps, and there is no Claude Code plugin marketplace in the repo. The skills.sh page gives this skills CLI command:

npx skills add https://github.com/mcollina/skills --skill oauth

Add -g for all projects or -a claude-code to target Claude Code. Claude Code reads standalone skills from .claude/skills/ in a project or ~/.claude/skills/ globally, per the Claude Code skills docs. The same folder works in other agents; see Codex skills and Cursor skills.

Because the examples assume Fastify, it pairs naturally with the Fastify skill:

npx skills add https://github.com/mcollina/skills --skill oauth --skill fastify-best-practices

How do you use it?

The skill is model-invoked, so the agent may load it when you mention login flows, access tokens or OAuth errors. You can also call it with /oauth in Claude Code.

Example prompts (suggestions, not quotes from the repo):

• Add "Sign in with our identity provider" to this Fastify app using authorization code with PKCE. Read the issuer and client settings from env.
• Protect every route under /api with JWT validation. Check exp, iss and aud and return OAuth-style 401 errors.
• We get "redirect_uri mismatch" from the provider in staging. Walk through what to check.
• Review our auth code against the skill's security checklist and list the gaps.

Give the agent your provider's endpoints and whether your app is a public or confidential client. The skill's code reads these from environment variables such as CLIENT_ID, AUTH_SERVER and CALLBACK_URI.

Tips and limits

From the repo and the sources linked here, not from testing:

• Fastify only in code. Every example uses Fastify plugins. The checklist is general, but the code needs adapting for other frameworks.
• Referenced files are missing. The SKILL.md points to DEVICE_FLOW.md, TOKEN_VALIDATION.md, CLIENT_CREDENTIALS.md and MOBILE_OAUTH.md for device flow, JWKS rotation, machine-to-machine auth and native apps. On 24 October 2026 the folder held only SKILL.md and tile.json, so those topics rest on the agent's general knowledge.
• Check method names against the plugin docs. The @fastify/oauth2 README names the refresh helper getNewAccessTokenUsingRefreshToken, while the skill calls getNewAccessTokenUsingRefreshTokenFlow. The README also describes the getAccessTokenFromAuthorizationCodeFlow(request, reply, callback) variant as "the recommended form and required when the PKCE extension is used", and its own example passes request, reply; the skill enables PKCE but its callback passes only request. Ask the agent to follow the plugin README.
• Rotation is a recommendation. The checklist says to rotate refresh tokens on every use and cites RFC 6749 §10.4. That section offers rotation as one way to detect refresh token abuse ("the authorization server could employ refresh token rotation"), so treat it as best practice rather than a requirement of RFC 6749.
• Security audits. On 24 October 2026, skills.sh showed Pass from Gen Agent Trust Hub, Socket and Snyk. The skill contains no scripts.

You can copy and change it under the MIT License if you keep the copyright notice.

Save it in your Kipt library

Kipt keeps prompts and skills as Markdown in a private GitHub repo you own. In Kipt, open Skills and paste the skills/oauth folder link into the import box, or paste the repo link to pick oauth and fastify-best-practices from a list. Dropping the folder or a .zip also works. Your library then installs into Claude Code or Codex with one command:

npx skills add https://github.com/<you>/<repo>.git --all -g

Kipt is not affiliated with Matteo Collina or mcollina/skills.

Similar skills

• Fastify skill: the server patterns the OAuth examples are built on.
• Better Auth skill: a full auth library setup if you'd rather not wire OAuth by hand.
• Convex auth skill: sign-in for Convex apps with @convex-dev/auth.
• Firebase Auth basics skill: Firebase's official skill for sign-in providers and client SDKs.
• Security hardening skill: threat modeling and OWASP defenses around your auth code.