Agent skill

Route Map

by gjovanovicst in gjovanovicst/golang-auth-api

Complete HTTP route structure with auth layers, middleware chains, rate limiting, and handler mappings for all API and GUI endpoints.

MITAuto-check passedBackend & APIs

Install Route Map

skills CLI

$ npx skills add gjovanovicst/golang-auth-api --skill route-map -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install gjovanovicst/golang-auth-api route-map --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/gjovanovicst/golang-auth-api.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.opencode/skills/route-map .claude/skills/route-map && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "route-map" agent skill from https://github.com/gjovanovicst/golang-auth-api/tree/main/.opencode/skills/route-map into .claude/skills/route-map/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "route-map", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/gjovanovicst/golang-auth-api/tree/main/.opencode/skills/route-map

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add gjovanovicst/golang-auth-api --skill route-map -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install gjovanovicst/golang-auth-api route-map --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/gjovanovicst/golang-auth-api.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.opencode/skills/route-map .agents/skills/route-map && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "route-map" agent skill from https://github.com/gjovanovicst/golang-auth-api/tree/main/.opencode/skills/route-map into .agents/skills/route-map/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "route-map", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add gjovanovicst/golang-auth-api --skill route-map -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install gjovanovicst/golang-auth-api route-map --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/gjovanovicst/golang-auth-api.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.opencode/skills/route-map .cursor/skills/route-map && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "route-map" agent skill from https://github.com/gjovanovicst/golang-auth-api/tree/main/.opencode/skills/route-map into .cursor/skills/route-map/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "route-map", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/gjovanovicst/golang-auth-api.git --path .opencode/skills/route-map

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add gjovanovicst/golang-auth-api --skill route-map -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install gjovanovicst/golang-auth-api route-map --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/gjovanovicst/golang-auth-api.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.opencode/skills/route-map .gemini/skills/route-map && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "route-map" agent skill from https://github.com/gjovanovicst/golang-auth-api/tree/main/.opencode/skills/route-map into .gemini/skills/route-map/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "route-map", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install gjovanovicst/golang-auth-api route-map

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add gjovanovicst/golang-auth-api --skill route-map -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/gjovanovicst/golang-auth-api.git skills-src && mkdir -p .github/skills && cp -r skills-src/.opencode/skills/route-map .github/skills/route-map && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "route-map" agent skill from https://github.com/gjovanovicst/golang-auth-api/tree/main/.opencode/skills/route-map into .github/skills/route-map/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "route-map", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add gjovanovicst/golang-auth-api --skill route-map -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install gjovanovicst/golang-auth-api route-map --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/gjovanovicst/golang-auth-api.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.opencode/skills/route-map .opencode/skills/route-map && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "route-map" agent skill from https://github.com/gjovanovicst/golang-auth-api/tree/main/.opencode/skills/route-map into .opencode/skills/route-map/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "route-map", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: route-map
GitHub stars: 130
Token cost: ~4.7k tokens
SKILL.md length: 416 words
Files: 1
Skills in repo: 6
Repo updated: Jul 30, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Complete HTTP route structure with auth layers, middleware chains, rate limiting, and handler mappings for all API and GUI endpoints.

Works in 3 steps: middleware.SecurityHeadersMiddleware()… → middleware.CORSMiddleware() -- CORS… → middleware.AppIDMiddleware() -- Extracts…
Tasks that involve Authentication
SKILL.md covers Route Architecture, Authentication Layers (4…, Public Routes (no auth, rate… and Social OAuth2 Routes (public,…, plus 8 more sections
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Route Map is an agent skill from gjovanovicst/golang-auth-api. Complete HTTP route structure with auth layers, middleware chains, rate limiting, and handler mappings for all API and GUI endpoints.

Its SKILL.md is about 4.7k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Backend & APIs, covering Authentication, Rate limiting and Authorization and RBAC. The repository describes itself as: A modern, production-ready Go REST API for authentication and authorization, featuring social login, email verification, JWT, and Redis integration. The licence is MIT.

When your agent uses it

Tasks that involve Authentication
Tasks that involve Rate limiting
Tasks that involve Authorization and RBAC

Example prompts

“/route-map”

Workflow steps

3 steps, taken from the first numbered list in SKILL.md.

middleware.SecurityHeadersMiddleware() -- CSP, HSTS, X-Frame-Options
middleware.CORSMiddleware() -- CORS headers
middleware.AppIDMiddleware() -- Extracts X-App-ID header (skips /swagger, /admin, /gui)

What it can do on your machine

Read from SKILL.md and the folder at commit 795d18d. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Route Map loads about 4.7k tokens when it runs. Until then it costs about 36 tokens; SKILL.md has 416 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~36
When it runs · the whole SKILL.md, loaded when a task matches: ~4.7k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from gjovanovicst/golang-auth-api at commit 795d18d, republished under its MIT licence (© gjovanovicst). 416 words, ~4,715 tokens.

Download SKILL.mdSave it as .claude/skills/route-map/SKILL.md (or your agent's skills folder).

name: route-map
description: Complete HTTP route structure with auth layers, middleware chains, rate limiting, and handler mappings for all API and GUI endpoints.
license: MIT

Route Architecture

All routes are defined in cmd/api/main.go. The server uses Gin with these global middleware applied to all routes:

middleware.SecurityHeadersMiddleware() -- CSP, HSTS, X-Frame-Options
middleware.CORSMiddleware() -- CORS headers
middleware.AppIDMiddleware() -- Extracts X-App-ID header (skips /swagger, /admin, /gui)

Authentication Layers (4 systems)

Layer	Mechanism	Header/Cookie	Middleware	Scope
User Auth	JWT Bearer	`Authorization: Bearer <token>`	`AuthMiddleware()`	End-user API routes
Admin API Key	API key	`X-Admin-API-Key`	`AdminAuthMiddleware(adminRepo)`	`/admin/*` JSON API
App API Key	API key	`X-App-API-Key` + `X-App-ID`	`AppApiKeyMiddleware(adminRepo)`	`/app/:id/*` routes
Admin GUI Session	HTTP-only cookie	`admin_session` cookie	`GUIAuthMiddleware(accountService)`	`/gui/*` HTML interface

Public Routes (no auth, rate limited)

POST /register                    -> userHandler.Register           [APIRegisterRateLimit: 3/min]
POST /login                       -> userHandler.Login              [APILoginRateLimit: 5/min, lockout 10->15min]
POST /refresh-token               -> userHandler.RefreshToken       [APIRefreshTokenRateLimit: 10/min]
POST /forgot-password             -> userHandler.ForgotPassword     [APIForgotPasswordRateLimit: 3/min]
POST /reset-password              -> userHandler.ResetPassword      [APIResetPasswordRateLimit: 5/min]
GET  /verify-email                -> userHandler.VerifyEmail
POST /resend-verification         -> userHandler.ResendVerification [APIResendVerificationRateLimit: 3/min]

POST /2fa/login-verify            -> twofaHandler.VerifyLogin       [API2FAVerifyRateLimit: 5/min, lockout 10->15min]
POST /2fa/email/resend            -> twofaHandler.ResendEmail2FACode [API2FAVerifyRateLimit]
POST /2fa/sms/resend              -> twofaHandler.ResendSMS2FACode  [API2FAVerifyRateLimit]
POST /2fa/backup-email/resend     -> twofaHandler.ResendBackupEmail2FACode [API2FAVerifyRateLimit]
GET  /2fa/backup-email/verify     -> twofaHandler.VerifyBackupEmail
GET  /2fa/methods                 -> twofaHandler.GetAvailableMethods

POST /2fa/passkey/begin           -> webauthnHandler.BeginPasskey2FA    [APIPasskey2FARateLimit: 10/min]
POST /2fa/passkey/finish          -> webauthnHandler.FinishPasskey2FA   [APIPasskey2FARateLimit]

POST /passkey/login/begin         -> webauthnHandler.BeginPasswordlessLogin  [APIPasskeyLoginRateLimit: 10/min]
POST /passkey/login/finish        -> webauthnHandler.FinishPasswordlessLogin [APIPasskeyLoginRateLimit]

POST /magic-link/request          -> userHandler.RequestMagicLink    [APIMagicLinkRateLimit: 5/15min]
POST /magic-link/verify           -> userHandler.VerifyMagicLink     [APIMagicLinkRateLimit]

GET  /health                      -> healthHandler.Health             (no auth)
GET  /app-config/:app_id          -> adminHandler.GetAppLoginConfig   (no auth)

GET /auth/google/login            -> socialHandler.GoogleLogin
GET /auth/google/callback         -> socialHandler.GoogleCallback
GET /auth/facebook/login          -> socialHandler.FacebookLogin
GET /auth/facebook/callback       -> socialHandler.FacebookCallback
GET /auth/github/login            -> socialHandler.GithubLogin
GET /auth/github/callback         -> socialHandler.GithubCallback

# Account linking callbacks (public -- user ID in OAuth state param)
GET /auth/google/link/callback    -> socialHandler.GoogleLinkCallback
GET /auth/facebook/link/callback  -> socialHandler.FacebookLinkCallback
GET /auth/github/link/callback    -> socialHandler.GithubLinkCallback

Account Linking Routes (JWT auth required)

GET /auth/google/link             -> socialHandler.GoogleLink       [AuthMiddleware]
GET /auth/facebook/link           -> socialHandler.FacebookLink     [AuthMiddleware]
GET /auth/github/link             -> socialHandler.GithubLink       [AuthMiddleware]

Protected User Routes (JWT auth + RBAC permissions)

All routes use AuthMiddleware(). RBAC permissions shown as resource:action.

# Profile (user:read, user:write, user:delete)
GET    /profile                   -> userHandler.GetProfile         [user:read]
PUT    /profile                   -> userHandler.UpdateProfile      [user:write]
DELETE /profile                   -> userHandler.DeleteAccount      [user:delete]
PUT    /profile/email             -> userHandler.UpdateEmail        [user:write]
PUT    /profile/password          -> userHandler.UpdatePassword     [user:write]

# Social accounts (user:read, user:write)
GET    /profile/social-accounts   -> socialHandler.ListSocialAccounts   [user:read]
DELETE /profile/social-accounts/:id -> socialHandler.UnlinkSocialAccount [user:write]

# Auth (no extra permission)
GET  /auth/validate               -> userHandler.ValidateToken
POST /logout                      -> userHandler.Logout

# 2FA management (settings:write, settings:read)
POST /2fa/generate                -> twofaHandler.Generate2FA       [settings:write]
POST /2fa/verify-setup            -> twofaHandler.VerifySetup       [settings:write]
POST /2fa/enable                  -> twofaHandler.Enable2FA         [settings:write]
POST /2fa/disable                 -> twofaHandler.Disable2FA        [settings:write]
POST /2fa/recovery-codes          -> twofaHandler.GenerateRecoveryCodes [settings:write]
POST /2fa/email/enable            -> twofaHandler.EnableEmail2FA    [settings:write]
POST /2fa/sms/enable              -> twofaHandler.EnableSMS2FA      [settings:write]
POST /2fa/backup-email            -> twofaHandler.AddBackupEmail    [settings:write]
DELETE /2fa/backup-email          -> twofaHandler.RemoveBackupEmail [settings:write]
GET    /2fa/backup-email/status   -> twofaHandler.BackupEmailStatus [settings:read]
POST /2fa/backup-email/enable     -> twofaHandler.EnableBackupEmail2FA  [settings:write]
POST /2fa/backup-email/disable    -> twofaHandler.DisableBackupEmail2FA [settings:write]
GET  /2fa/trusted-devices         -> twofaHandler.ListTrustedDevices    [settings:read]
DELETE /2fa/trusted-devices/:id   -> twofaHandler.RevokeTrustedDevice   [settings:write]
DELETE /2fa/trusted-devices       -> twofaHandler.RevokeAllTrustedDevices [settings:write]

# Phone / SMS management (settings:write, settings:read)
POST   /phone                     -> twofaHandler.AddPhone          [settings:write]
POST   /phone/verify              -> twofaHandler.VerifyPhone       [settings:write]
DELETE /phone                     -> twofaHandler.RemovePhone       [settings:write]
GET    /phone/status              -> twofaHandler.PhoneStatus       [settings:read]

# Passkey management (settings:write, settings:read)
POST   /passkey/register/begin    -> webauthnHandler.BeginRegistration   [settings:write]
POST   /passkey/register/finish   -> webauthnHandler.FinishRegistration  [settings:write]
GET    /passkeys                  -> webauthnHandler.ListCredentials     [settings:read]
PUT    /passkeys/:id              -> webauthnHandler.RenameCredential    [settings:write]
DELETE /passkeys/:id              -> webauthnHandler.DeleteCredential    [settings:write]

# Activity logs (log:read)
GET /activity-logs                -> logHandler.GetUserActivityLogs      [log:read]
GET /activity-logs/event-types    -> logHandler.GetEventTypes            [log:read]
GET /activity-logs/:id            -> logHandler.GetActivityLogByID       [log:read]
GET /activity-logs/export         -> logHandler.ExportUserActivityLogs   [log:read]

# Sessions (no extra permission)
GET    /sessions                  -> sessionHandler.ListSessions
DELETE /sessions/:id              -> sessionHandler.RevokeSession
DELETE /sessions                  -> sessionHandler.RevokeAllSessions

Admin API Routes (Admin API Key auth)

All routes use AdminAuthMiddleware(adminRepo). Header: X-Admin-API-Key.

# Metrics (Admin API Key required)
GET  /metrics                     -> healthHandler.Metrics

# Activity logs
GET /admin/activity-logs          -> logHandler.GetAllActivityLogs
GET /admin/activity-logs/export   -> logHandler.ExportAllActivityLogs

# Tenants
POST /admin/tenants               -> adminHandler.CreateTenant
GET  /admin/tenants               -> adminHandler.ListTenants

# Applications
POST /admin/apps                  -> adminHandler.CreateApp
GET  /admin/apps/:id              -> adminHandler.GetAppDetails
POST /admin/apps/:id/oauth-config -> adminHandler.UpsertOAuthConfig

# IP Rules (per-app)
GET    /admin/apps/:id/ip-rules           -> adminHandler.ListIPRules
POST   /admin/apps/:id/ip-rules           -> adminHandler.CreateIPRule
GET    /admin/apps/:id/ip-rules/:rule_id  -> adminHandler.GetIPRule
PUT    /admin/apps/:id/ip-rules/:rule_id  -> adminHandler.UpdateIPRule
DELETE /admin/apps/:id/ip-rules/:rule_id  -> adminHandler.DeleteIPRule
POST   /admin/apps/:id/ip-rules/check     -> adminHandler.CheckIPAccess

# User import/export
GET  /admin/users/export          -> adminHandler.ExportUsers
POST /admin/users/import          -> adminHandler.ImportUsers

# Trusted devices (admin)
GET    /admin/users/:id/trusted-devices -> adminHandler.ListUserTrustedDevices
DELETE /admin/users/:id/trusted-devices -> adminHandler.RevokeAllUserTrustedDevices

# Webhooks
GET    /admin/webhooks                         -> webhookHandler.AdminListEndpoints
GET    /admin/webhooks/apps/:app_id            -> webhookHandler.AdminListEndpointsByApp
POST   /admin/webhooks/apps/:app_id            -> webhookHandler.AdminCreateEndpoint
PUT    /admin/webhooks/:id/toggle              -> webhookHandler.AdminToggleEndpoint
DELETE /admin/webhooks/:id                     -> webhookHandler.AdminDeleteEndpoint
GET    /admin/webhooks/:id/deliveries          -> webhookHandler.AdminListDeliveriesByEndpoint
GET    /admin/webhooks/apps/:app_id/deliveries -> webhookHandler.AdminListDeliveriesByApp

# OIDC client management
POST   /admin/oidc/apps/:id/clients           -> oidcHandler.AdminCreateClient
GET    /admin/oidc/apps/:id/clients           -> oidcHandler.AdminListClients
GET    /admin/oidc/apps/:id/clients/:cid      -> oidcHandler.AdminGetClient
PUT    /admin/oidc/apps/:id/clients/:cid      -> oidcHandler.AdminUpdateClient
DELETE /admin/oidc/apps/:id/clients/:cid      -> oidcHandler.AdminDeleteClient
POST   /admin/oidc/apps/:id/clients/:cid/rotate-secret -> oidcHandler.AdminRotateClientSecret

# Email types
GET    /admin/email-types         -> adminHandler.ListEmailTypes
GET    /admin/email-types/:code   -> adminHandler.GetEmailType
POST   /admin/email-types         -> adminHandler.CreateEmailType
PUT    /admin/email-types/:id     -> adminHandler.UpdateEmailType
DELETE /admin/email-types/:id     -> adminHandler.DeleteEmailType

# Email templates
GET    /admin/email-templates     -> adminHandler.ListEmailTemplates
GET    /admin/email-templates/:id -> adminHandler.GetEmailTemplate
POST   /admin/email-templates     -> adminHandler.SaveEmailTemplate
DELETE /admin/email-templates/:id -> adminHandler.DeleteEmailTemplate
POST   /admin/email-templates/preview -> adminHandler.PreviewEmailTemplate

# Email variables
GET /admin/email-variables        -> adminHandler.ListWellKnownVariables

# Email server configs (per-app)
GET    /admin/apps/:id/email-config    -> adminHandler.GetEmailServerConfig
PUT    /admin/apps/:id/email-config    -> adminHandler.SaveEmailServerConfig
DELETE /admin/apps/:id/email-config    -> adminHandler.DeleteEmailServerConfig
POST   /admin/apps/:id/email-test      -> adminHandler.SendTestEmail
GET    /admin/apps/:id/email-servers   -> adminHandler.ListEmailServerConfigsByApp

# Email server configs (global CRUD)
GET    /admin/email-servers            -> adminHandler.ListAllEmailServerConfigs
GET    /admin/email-servers/:id        -> adminHandler.GetEmailServerConfigByID
POST   /admin/email-servers            -> adminHandler.CreateEmailServerConfig
PUT    /admin/email-servers/:id        -> adminHandler.UpdateEmailServerConfigByID
DELETE /admin/email-servers/:id        -> adminHandler.DeleteEmailServerConfigByID
POST   /admin/email-servers/:id/test   -> adminHandler.SendTestEmailByConfigID

# Send email
POST /admin/apps/:id/send-email  -> adminHandler.SendCustomEmail

# RBAC
GET    /admin/rbac/roles          -> rbacHandler.ListRoles
GET    /admin/rbac/roles/:id      -> rbacHandler.GetRole
POST   /admin/rbac/roles          -> rbacHandler.CreateRole
PUT    /admin/rbac/roles/:id      -> rbacHandler.UpdateRole
DELETE /admin/rbac/roles/:id      -> rbacHandler.DeleteRole
PUT    /admin/rbac/roles/:id/permissions -> rbacHandler.SetRolePermissions
GET    /admin/rbac/permissions    -> rbacHandler.ListPermissions
POST   /admin/rbac/permissions    -> rbacHandler.CreatePermission
GET    /admin/rbac/user-roles     -> rbacHandler.ListUserRoles
POST   /admin/rbac/user-roles     -> rbacHandler.AssignRole
DELETE /admin/rbac/user-roles     -> rbacHandler.RevokeRole
GET    /admin/rbac/user-roles/user -> rbacHandler.GetUserRoles

App API Routes (Per-App API Key auth)

Middleware chain: AppApiKeyMiddleware(adminRepo) + AppRouteGuardMiddleware(). Headers: X-App-API-Key + X-App-ID (must match :id in URL).

GET  /app/:id/email-config        -> adminHandler.GetEmailServerConfig
GET  /app/:id/email-servers       -> adminHandler.ListEmailServerConfigsByApp
POST /app/:id/email-test          -> adminHandler.SendTestEmail
POST /app/:id/send-email          -> adminHandler.SendCustomEmail

# Webhooks (App API Key)
GET    /app/:id/webhooks                  -> webhookHandler.AppListEndpoints
POST   /app/:id/webhooks                  -> webhookHandler.AppCreateEndpoint
PUT    /app/:id/webhooks/:wid/toggle      -> webhookHandler.AppToggleEndpoint
DELETE /app/:id/webhooks/:wid             -> webhookHandler.AppDeleteEndpoint
GET    /app/:id/webhooks/:wid/deliveries  -> webhookHandler.AppListDeliveries

OIDC Provider Routes (opt-in, requires OIDC_ENABLED on application)

GET  /.well-known/openid-configuration    -> redirect to /oidc/:app_id/.well-known/openid-configuration

GET  /oidc/:app_id/.well-known/openid-configuration -> oidcHandler.WellKnownConfiguration
GET  /oidc/:app_id/.well-known/jwks.json             -> oidcHandler.JWKS
GET  /oidc/:app_id/authorize             -> oidcHandler.Authorize              [OIDCAuthorizeRateLimit]
POST /oidc/:app_id/authorize             -> oidcHandler.AuthorizeSubmit        [OIDCAuthorizeRateLimit]
POST /oidc/:app_id/token                 -> oidcHandler.Token                  [OIDCTokenRateLimit]
GET  /oidc/:app_id/userinfo              -> oidcHandler.UserInfo               [OIDCUserInfoRateLimit]
POST /oidc/:app_id/userinfo              -> oidcHandler.UserInfo               [OIDCUserInfoRateLimit]
POST /oidc/:app_id/introspect            -> oidcHandler.Introspect             [OIDCIntrospectRateLimit]
POST /oidc/:app_id/revoke                -> oidcHandler.Revoke                 [OIDCRevokeRateLimit]
GET  /oidc/:app_id/end_session           -> oidcHandler.EndSession
POST /oidc/:app_id/end_session           -> oidcHandler.EndSession

GUI Routes (Admin Web Interface)

Static assets and login pages are public. Authenticated routes use GUIAuthMiddleware + CSRFMiddleware.

Public GUI routes

GET  /gui/static/*                -> static.HTTPFileSystem()
GET  /gui/login                   -> guiHandler.LoginPage
POST /gui/login                   -> guiHandler.LoginSubmit        [LoginRateLimit: 5/min]
POST /gui/passkey-login/begin     -> guiHandler.PasskeyLoginBegin  [GUIPasskeyLoginRateLimit: 10/min]
POST /gui/passkey-login/finish    -> guiHandler.PasskeyLoginFinish [GUIPasskeyLoginRateLimit]
POST /gui/magic-link-login        -> guiHandler.MagicLinkLoginRequest [GUIMagicLinkRateLimit: 3/15min]
GET  /gui/magic-link-login/verify -> guiHandler.MagicLinkLoginVerify
GET  /gui/2fa-verify              -> guiHandler.TwoFAVerifyPage
POST /gui/2fa-verify              -> guiHandler.TwoFAVerifySubmit
POST /gui/2fa-resend-email        -> guiHandler.TwoFAResendEmail

Covers: Dashboard, Tenants, Applications, OAuth, Users (with export/import, trusted device management), Logs (with CSV export), API Keys (with scope config and usage stats), Settings, Email Servers, Email Templates, Email Types, Roles, Permissions, User Roles, Sessions, Webhooks, OIDC Clients, IP Rules, Monitoring, My Account (email, password, 2FA, passkeys, magic link, backup email, trusted devices), Social Account/Passkey management for users.

Each entity follows the HTMX CRUD pattern:

GET  /gui/<entity>                -> Page (full page)
GET  /gui/<entity>/list           -> List (HTMX partial, paginated)
GET  /gui/<entity>/new            -> CreateForm (HTMX partial)
POST /gui/<entity>                -> Create
GET  /gui/<entity>/form-cancel    -> FormCancel (HTMX partial)
GET  /gui/<entity>/:id/edit       -> EditForm (HTMX partial)
PUT  /gui/<entity>/:id            -> Update
GET  /gui/<entity>/:id/delete     -> DeleteConfirm (HTMX partial)
DELETE /gui/<entity>/:id          -> Delete

Show full SKILL.md (161 more words)Show less

Rate Limiting Summary

Endpoint Group	Prefix	Limit	Window	Lockout
GUI Login	`gui:login`	5/min	60s	10 attempts -> 15min lockout
API Login	`api:login`	5/min	60s	10 -> 15min
API Register	`api:register`	3/min	60s	none
API Forgot Password	`api:forgot-password`	3/min	60s	none
API Resend Verification	`api:resend-verification`	3/min	60s	none
API Refresh Token	`api:refresh-token`	10/min	60s	none
API Reset Password	`api:reset-password`	5/min	60s	none
API 2FA Verify	`api:2fa-verify`	5/min	60s	10 -> 15min
API Passkey Login	`api:passkey-login`	10/min	60s	20 -> 15min
API Passkey 2FA	`api:passkey-2fa`	10/min	60s	20 -> 15min
API Magic Link	`api:magic-link`	5/15min	15min	none
GUI Magic Link	`gui:magic-link`	3/15min	15min	none
GUI Passkey Login	`gui:passkey-login`	10/min	60s	20 -> 15min
OIDC Authorize	`oidc:authorize`	20/min	60s	none
OIDC Token	`oidc:token`	30/min	60s	none
OIDC UserInfo	`oidc:userinfo`	60/min	60s	none
OIDC Introspect	`oidc:introspect`	30/min	60s	none
OIDC Revoke	`oidc:revoke`	30/min	60s	none

When To Use This Skill

Load this skill when working on API endpoints, adding new routes, modifying middleware chains, changing rate limits, or debugging request flows.

Files

Just SKILL.md in .opencode/skills/route-map of gjovanovicst/golang-auth-api.

Open the folder on GitHubat commit 795d18d

Compare with similar skills

Route Map next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Route Map compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Route Map this skillgjovanovicst/golang-auth-api	130	—	~4.7k	Automated safety check: Pass	MIT	2 mo ago
API Auditbriiirussell/cybersecurity-skills	413	—	~2.8k	Automated safety check: Notes	MIT	4 mo ago
Auth Architecturemajiayu000/litellm-rs	117	—	~1.9k	Automated safety check: Pass	MIT	today
Springboot Securityaffaan-m/ECC	275k	5 repos	~2k	Automated safety check: Pass	MIT	3 days ago
Discover APIrand/cc-polymath	181	1 repos	~1.5k	Automated safety check: Pass	MIT	7 mo ago
API Security Designvinayaklatthe/microsoft-security-skills	175	—	~2.2k	Automated safety check: Pass	MIT	3 mo ago

Similar skills

API Audit
briiirussell/cybersecurity-skills
Audit REST, GraphQL, and RPC APIs against the OWASP API Security Top 10 (2023).
413 GitHub stars~2.8k tokensUpdated 4 mo ago
Backend & APIsAuto-check: notes
Auth Architecture
majiayu000/litellm-rs
LiteLLM-RS Authentication Architecture. An agent skill from majiayu000/litellm-rs.
117 GitHub stars~1.9k tokensUpdated today
Backend & APIsAuto-check passed
Springboot Security
affaan-m/ECC
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
275k GitHub starsUsed in 5 repos~2k tokens
Backend & APIsAuto-check passed
Discover API
rand/cc-polymath
Automatically discover API design skills when working with REST APIs, GraphQL schemas, API authentication, OAuth, JWT, rate limiting, API versioning, error handling, or endpoint design.
181 GitHub starsUsed in 1 repo~1.5k tokens
Backend & APIsAuto-check passed
API Security Design
vinayaklatthe/microsoft-security-skills
Guidance for designing secure APIs on Azure - authentication, authorization, gateway controls, input validation, rate limiting, secret management, and runtime threat detection - aligned to OWASP API…
175 GitHub stars~2.2k tokensUpdated 3 mo ago
Backend & APIsAuto-check passed
Laravel Security
affaan-m/ECC
Laravel security best practices for authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.
275k GitHub starsUsed in 3 repos~2k tokens
Backend & APIsAuto-check passed

Questions about Route Map

What does Route Map do?

Complete HTTP route structure with auth layers, middleware chains, rate limiting, and handler mappings for all API and GUI endpoints. Route Map is an agent skill from gjovanovicst/golang-auth-api. Complete HTTP route structure with auth layers, middleware chains, rate limiting, and handler mappings for all API and GUI endpoints.

When should I use Route Map?

Route Map fits situations like: tasks that involve Authentication; tasks that involve Rate limiting; tasks that involve Authorization and RBAC.

How do I install Route Map in Claude Code?

Run `npx skills add gjovanovicst/golang-auth-api --skill route-map -a claude-code`. Or copy the skill folder (.opencode/skills/route-map in gjovanovicst/golang-auth-api) into .claude/skills/route-map in your project. Claude Code loads it when a task matches its description.

How do I install Route Map in Codex?

Run `npx skills add gjovanovicst/golang-auth-api --skill route-map -a codex`. Or copy the skill folder (.opencode/skills/route-map in gjovanovicst/golang-auth-api) into .agents/skills/route-map in your project. Codex loads it when a task matches its description.

Can I use Route Map in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add gjovanovicst/golang-auth-api --skill route-map -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/route-map, .gemini/skills/route-map, .github/skills/route-map and .opencode/skills/route-map in your project.

What does Route Map need to run?

SKILL.md names no scripts, command-line tools or credentials: Route Map is instructions for the agent only.

Does Route Map access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Route Map safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Route Map use?

Route Map is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Route Map use?

About 4.7k tokens (SKILL.md is roughly 19k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Route Map?

Skills that share tags, products or a category with Route Map: API Audit (briiirussell/cybersecurity-skills, 413 stars), Auth Architecture (majiayu000/litellm-rs, 117 stars), Springboot Security (affaan-m/ECC, 275k stars) and Discover API (rand/cc-polymath, 181 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Route Map?

gjovanovicst (a GitHub user) maintains it in gjovanovicst/golang-auth-api, which has 130 GitHub stars. The repository holds 6 skills in this directory. The repository was last updated on July 30, 2026.

Source: gjovanovicst/golang-auth-api on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Route Map

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Route Architecture

Authentication Layers (4 systems)

Public Routes (no auth, rate limited)

Social OAuth2 Routes (public, no rate limit)

Account Linking Routes (JWT auth required)

Protected User Routes (JWT auth + RBAC permissions)

Admin API Routes (Admin API Key auth)

App API Routes (Per-App API Key auth)

OIDC Provider Routes (opt-in, requires OIDC_ENABLED on application)

GUI Routes (Admin Web Interface)

Public GUI routes

Authenticated GUI routes (cookie session + CSRF)

Rate Limiting Summary

When To Use This Skill

Files

Compare with similar skills

Similar skills

More from gjovanovicst/golang-auth-api

Related

Questions about Route Map