Agent skill

Maui Authentication

by davidortinau in davidortinau/maui-skills

Add authentication to .NET MAUI apps. An agent skill from davidortinau/maui-skills.

MITAuto-check passedBackend & APIs

Install Maui Authentication

skills CLI
$ npx skills add davidortinau/maui-skills --skill maui-authentication -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install davidortinau/maui-skills maui-authentication --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/davidortinau/maui-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/maui-skills/skills/maui-authentication .claude/skills/maui-authentication && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
maui-authentication
GitHub stars
175
Token cost
~1.5k tokens
SKILL.md length
511 words
Files
2 (incl. references)
Skills in repo
41
Repo updated
First seen
Licence
MIT

At a glance

Add authentication to .NET MAUI apps. An agent skill from davidortinau/maui-skills.

  • Works in 4 steps: App calls WebAuthenticator pointing to… → Server initiates the OAuth flow with the… → Provider redirects back to your server… → …
  • : add authentication
  • SKILL.md covers Security: Never Embed Secrets, WebAuthenticator Gotchas, WebAuthenticator Checklist and Choosing Between…, plus 2 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Maui Authentication is an agent skill from davidortinau/maui-skills. Add authentication to .NET MAUI apps. Covers WebAuthenticator for generic OAuth 2.0 / social login, and MSAL.NET for Microsoft Entra ID (Azure AD) with broker support (Microsoft Authenticator), token caching, Conditional Access, platform-specific setup (Android, iOS, Windows), DelegatingHandler for bearer token API calls, and Blazor Hybrid integration. USE FOR: "add authentication", "OAuth login", "MSAL.NET", "social login", "WebAuthenticator", "Entra ID MAUI", "Azure AD login", "Google login MAUI", "Apple login…

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/authentication-api.md`).

It sits in Backend & APIs, covering Cross-platform mobile apps, Authentication and OAuth and OpenID Connect. It works with Microsoft Entra ID, Android, iOS and Blazor. The repository describes itself as: .NET MAUI skills for GitHub Copilot and Claude Code. The licence is MIT.

When your agent uses it

  • : add authentication
  • WebAuthenticator
  • Google login MAUI
  • Apple login MAUI

Example prompts

  • “add authentication”
  • “OAuth login”
  • “MSAL.NET”
  • “/maui-authentication”

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. App calls WebAuthenticator pointing to your server endpoint
  2. Server initiates the OAuth flow with the identity provider (holds the client secret)
  3. Provider redirects back to your server with an auth code
  4. Server exchanges the code for tokens and returns them to the app via the callback URI

What it can do on your machine

Read from SKILL.md and the folder at commit 79bb4bf. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are csharp).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • github.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Maui Authentication loads about 1.5k tokens when it runs, and up to ~5.8k if it reads all its reference files. Until then it costs about 195 tokens; SKILL.md has 511 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~195
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~5.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from davidortinau/maui-skills at commit 79bb4bf, republished under its MIT licence (© davidortinau). 511 words, ~1,499 tokens.

Download SKILL.mdSave it as .claude/skills/maui-authentication/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
maui-authentication
description
Add authentication to .NET MAUI apps. Covers WebAuthenticator for generic OAuth 2.0 / social login, and MSAL.NET for Microsoft Entra ID (Azure AD) with broker support (Microsoft Authenticator), token caching, Conditional Access, platform-specific setup (Android, iOS, Windows), DelegatingHandler for bearer token API calls, and Blazor Hybrid integration. USE FOR: "add authentication", "OAuth login", "MSAL.NET", "social login", "WebAuthenticator", "Entra ID MAUI", "Azure AD login", "Google login MAUI", "Apple login MAUI", "token caching", "bearer token", "sign in". DO NOT USE FOR: secure local storage of tokens (use maui-secure-storage), Aspire-specific auth setup (use maui-aspire), or server-side Entra ID provisioning (use entra-id-aspire-provisioning).

.NET MAUI Authentication

Security: Never Embed Secrets

❌ Never embed client secrets, API keys, or signing keys in a mobile app binary. They can be extracted trivially via decompilation.

The correct pattern:

  1. App calls WebAuthenticator pointing to your server endpoint
  2. Server initiates the OAuth flow with the identity provider (holds the client secret)
  3. Provider redirects back to your server with an auth code
  4. Server exchanges the code for tokens and returns them to the app via the callback URI

WebAuthenticator Gotchas

⚠️ Windows WebAuthenticator is broken

Windows WebAuthenticator is currently broken. See dotnet/maui#2702. Use MSAL or a WinUI-specific workaround for Windows auth flows.

⚠️ Apple Sign In returns name/email only once

Apple only returns the user's name and email on the first sign-in. Cache them immediately — subsequent sign-ins won't include them.

⚠️ PrefersEphemeralWebBrowserSession

Set to true on iOS 13+ to force a fresh login prompt. When false (default), the auth session shares cookies with Safari — the user may be auto-logged in, which can confuse logout/switch-account flows.

⚠️ Callback URI mismatches

The most common auth failure is a URI scheme mismatch. The CallbackUrl in code must exactly match:

  • Android: DataScheme + DataHost in the IntentFilter
  • iOS: CFBundleURLSchemes in Info.plist
  • Windows: Protocol Name in Package.appxmanifest

WebAuthenticator Checklist

  • Callback URI scheme matches across all platform configs and CallbackUrl
  • Android has WebAuthenticatorCallbackActivity with correct IntentFilter
  • Android 11+ has <queries> for Custom Tabs in the manifest
  • iOS/Mac Catalyst has CFBundleURLTypes in Info.plist
  • Client secrets are on the server, not in the app
  • Tokens stored with SecureStorage, cleared on logout
  • TaskCanceledException handled gracefully in UI

Choosing Between WebAuthenticator and MSAL.NET

CriteriaWebAuthenticatorMSAL.NET
Identity providerAny OAuth 2.0 / OIDCMicrosoft Entra ID
Broker support (SSO)❌ No✅ Microsoft Authenticator, Company Portal
Conditional Access / MFA❌ Manual✅ Built-in
Token cache & refresh❌ Manual (SecureStorage)✅ Automatic
ComplexitySimpleMore setup
Use whenGoogle, Apple, generic OIDCEntra ID / Azure AD, Microsoft Graph

Show full SKILL.md (202 more words)Show less

MSAL.NET Gotchas

⚠️ Android: OnActivityResult is required

Forgetting AuthenticationContinuationHelper.SetAuthenticationContinuationEventArgs in MainActivity.OnActivityResult causes auth to hang silently after the browser returns.

⚠️ iOS: Keychain sharing is required

Without Entitlements.plist containing keychain group com.microsoft.adalcache, token caching fails silently and users are prompted to sign in every time.

⚠️ Handle MsalUiRequiredException

When AcquireTokenSilent throws MsalUiRequiredException, the cached token is expired and interaction is needed. Always fall back to AcquireTokenInteractive.

csharp
// ❌ Ignoring MsalUiRequiredException — user gets a crash
var result = await _pca.AcquireTokenSilent(scopes, account).ExecuteAsync(ct);

// ✅ Fall back to interactive when silent fails
try
{
    result = await _pca.AcquireTokenSilent(scopes, account).ExecuteAsync(ct);
}
catch (MsalUiRequiredException)
{
    result = await _pca.AcquireTokenInteractive(scopes).ExecuteAsync(ct);
}
⚠️ Handle user cancellation gracefully
csharp
// ✅ Don't treat cancellation as an error
catch (MsalClientException ex) when (ex.ErrorCode == "authentication_canceled")
{
    return null;  // User cancelled — not an error
}
⚠️ Blazor Hybrid: Auth happens at the MAUI layer

In MAUI Blazor Hybrid apps, authentication must happen at the MAUI layer (MSAL.NET), not in the Blazor WebView. Don't use AddMicrosoftIdentityWebApp or server-side OIDC patterns. Instead:

  1. MAUI handles sign-in via IAuthService (MSAL.NET)
  2. A custom MsalAuthenticationStateProvider exposes auth state to Blazor
  3. HttpClient with DelegatingHandler attaches bearer tokens automatically

MSAL.NET Checklist

  • Microsoft.Identity.Client NuGet package added
  • App registration created in Entra ID with correct redirect URIs
  • AuthConfig / appsettings.json has ClientId, TenantId, Scopes
  • Android: AndroidManifest.xml has <queries> for broker and browsers
  • Android: MainActivity.OnActivityResult calls AuthenticationContinuationHelper
  • iOS: Info.plist has CFBundleURLSchemes with msauth.{BundleId}
  • iOS: Entitlements.plist has keychain group com.microsoft.adalcache
  • iOS: AppDelegate.OpenUrl calls AuthenticationContinuationHelper
  • IAuthService registered as singleton in DI
  • DelegatingHandler attached to HttpClient for API calls
  • Login/logout UI wired up
  • MsalUiRequiredException handled (triggers interactive sign-in)
  • MsalClientException with authentication_canceled handled gracefully

© davidortinau, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in plugins/maui-skills/skills/maui-authentication of davidortinau/maui-skills.

  • SKILL.md
  • references/authentication-api.md

Open the folder on GitHubat commit 79bb4bf

Compare with similar skills

Maui Authentication next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Maui Authentication compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Maui Authentication this skilldavidortinau/maui-skills175—~1.5kAutomated safety check: PassMIT
Web3authWeb3Auth/web3auth-examples144—~1.4kAutomated safety check: PassMIT
Maui AI DebuggingRedth/Maui.Gtk101—~4.1kAutomated safety check: PassMIT
MAUI Integration Test Runnerdotnet/maui23k—~2.1kAutomated safety check: PassMIT
Maui Safe Areadotnet/skills5.6k1 repos~3.2kAutomated safety check: PassMIT
Clerk Expogeekskai/blog103—~2.8kAutomated safety check: NotesMIT

Similar skills

  • Web3auth

    Web3Auth/web3auth-examples

    Integrates MetaMask Embedded Wallets (Web3Auth) for non-custodial wallets via social login or custom JWT (Firebase, Auth0, Cognito).

    144 GitHub stars~1.4k tokensUpdated 6 days ago
    Backend & APIsAuto-check passed
  • Maui AI Debugging

    Redth/Maui.Gtk

    End-to-end workflow for building, deploying, inspecting, and debugging .NET MAUI and MAUI Blazor Hybrid apps as an AI agent.

    101 GitHub stars~4.1k tokensUpdated 5 mo ago
    MobileAuto-check passed
  • Official

    Builds and packs .NET MAUI, installs the local workloads and runs integration tests for templates, samples and end-to-end scenarios by category.

    23k GitHub stars~2.1k tokensUpdated today
    Testing & QAAuto-check passed
  • Maui Safe Area

    dotnet/skills

    Official

    .NET MAUI safe area and edge-to-edge layout guidance for .NET 10+.

    5.6k GitHub starsUsed in 1 repo~3.2k tokens
    MobileAuto-check passed
  • Clerk Expo

    geekskai/blog

    Add Clerk authentication to Expo and React Native apps using @clerk/expo.

    103 GitHub stars~2.8k tokensUpdated 2 days ago
    MobileAuto-check: notes
  • Azure APIM Policy Authoring

    thomast1906/github-copilot-agent-skills

    Generates Azure API Management policy XML for authentication, rate limiting, CORS, error handling and transformations, consulting Azure best-practice and documentation tools first.

    202 GitHub stars~1.5k tokensUpdated 2 days ago
    Backend & APIsAuto-check passed

More from davidortinau/maui-skills

All 41 skills in this repo
  • Maui Hot Reload Diagnostics

    davidortinau/maui-skills

    Diagnose and troubleshoot .NET MAUI Hot Reload issues (C Hot Reload, XAML Hot Reload, Blazor Hybrid).

    175 GitHub stars~1.3k tokensUpdated 3 mo ago
    Auto-check passed
  • Maui Accessibility

    davidortinau/maui-skills

    Guide for making .NET MAUI apps accessible — screen reader support via SemanticProperties, heading levels, AutomationProperties visibility control, programmatic focus and announcements, and…

    175 GitHub stars~974 tokensUpdated 3 mo ago
    Auto-check passed
  • Maui Animations

    davidortinau/maui-skills

    .NET MAUI view animations, custom animations, easing functions, rotation, scale, translation, and fade effects.

    175 GitHub stars~911 tokensUpdated 3 mo ago
    Auto-check passed
  • Maui App Icons Splash

    davidortinau/maui-skills

    .NET MAUI app icon configuration, splash screen setup, SVG to PNG conversion at build time, composed/adaptive icons, and platform-specific icon and splash screen requirements for Android, iOS, Mac…

    175 GitHub stars~995 tokensUpdated 3 mo ago
    Auto-check passed
  • Maui App Lifecycle

    davidortinau/maui-skills

    .NET MAUI app lifecycle guidance covering the four app states (not running, running, deactivated, stopped), cross-platform Window lifecycle events, backgrounding and resume behaviour…

    175 GitHub stars~947 tokensUpdated 3 mo ago
    Auto-check passed
  • Maui Aspire

    davidortinau/maui-skills

    Guide for .NET MAUI apps consuming .NET Aspire-hosted backend services.

    175 GitHub stars~1.3k tokensUpdated 3 mo ago
    Auto-check passed

Questions about Maui Authentication

What does Maui Authentication do?

Add authentication to .NET MAUI apps. An agent skill from davidortinau/maui-skills. Maui Authentication is an agent skill from davidortinau/maui-skills.NET MAUI apps.

When should I use Maui Authentication?

Maui Authentication fits situations like: : add authentication; webAuthenticator; google login MAUI; apple login MAUI.

How do I install Maui Authentication in Claude Code?

Run `npx skills add davidortinau/maui-skills --skill maui-authentication -a claude-code`. Or copy the skill folder (plugins/maui-skills/skills/maui-authentication in davidortinau/maui-skills) into .claude/skills/maui-authentication in your project. Claude Code loads it when a task matches its description.

How do I install Maui Authentication in Codex?

Run `npx skills add davidortinau/maui-skills --skill maui-authentication -a codex`. Or copy the skill folder (plugins/maui-skills/skills/maui-authentication in davidortinau/maui-skills) into .agents/skills/maui-authentication in your project. Codex loads it when a task matches its description.

Can I use Maui Authentication in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add davidortinau/maui-skills --skill maui-authentication -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/maui-authentication, .gemini/skills/maui-authentication, .github/skills/maui-authentication and .opencode/skills/maui-authentication in your project.

What does Maui Authentication need to run?

SKILL.md names no scripts, command-line tools or credentials: Maui Authentication is instructions for the agent only.

Does Maui Authentication access the network?

SKILL.md names 1 domain. As links in the text: github.com. This is read from the text; nothing was executed.

Is Maui Authentication safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Maui Authentication use?

Maui Authentication is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Maui Authentication use?

About 1.5k tokens (SKILL.md is roughly 6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 4.3k tokens, read only when the agent opens those files.

What are the alternatives to Maui Authentication?

Skills that share tags, products or a category with Maui Authentication: Web3auth (Web3Auth/web3auth-examples, 144 stars), Maui AI Debugging (Redth/Maui.Gtk, 101 stars), MAUI Integration Test Runner (dotnet/maui, 23k stars) and Maui Safe Area (dotnet/skills, 5.6k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Maui Authentication?

davidortinau (a GitHub user) maintains it in davidortinau/maui-skills, which has 175 GitHub stars. The repository holds 41 skills in this directory. The repository was last updated on July 6, 2026.

Source: davidortinau/maui-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.