Auth Architecture

What it does

When your agent uses it

• Adding auth methods
• Debugging JWT/API-key validation
• Implementing RBAC permission checks
• Tuning rate limiting and auth configuration

Example prompts

• “/auth-architecture”

Workflow steps

6 steps, taken from the first numbered list in SKILL.md.

1. 1Authorization: Bearer → AuthMethod::Jwt
2. 2Authorization: ApiKey → AuthMethod::ApiKey
3. 3Authorization: gw-... (raw key, no scheme) → AuthMethod::ApiKey
4. 4Configured API key header (auth.api_key_header, default Authorization)
5. 5X-API-Key fallback (when the configured header differs)
6. 6session= cookie → AuthMethod::Session

What it can do on your machine

Read from SKILL.md and the folder at commit ed3f4d9. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  No scripts in the folder and no shell commands in SKILL.md (its code samples are rust).

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Auth Architecture loads about 1.9k tokens when it runs. Until then it costs about 95 tokens; SKILL.md has 483 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~95

When it runs · the whole SKILL.md, loaded when a task matches

~1.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from majiayu000/litellm-rs at commit ed3f4d9, republished under its MIT licence (© majiayu000). 483 words, ~1,908 tokens.

name

auth-architecture

description

LiteLLM-RS Authentication Architecture. Covers JWT + API Key + RBAC multi-method auth, DashMap-backed rate limiting, the actix-web middleware pipeline, and credential management (gw- prefixed keys, HMAC hashing). Use when adding auth methods, debugging JWT/API-key validation, implementing RBAC permission checks, or tuning rate limiting and auth configuration.

pub struct AuthSystem {
    config: Arc<AuthConfig>,
    storage: Arc<StorageLayer>,
    jwt: Arc<JwtHandler>,        // src/auth/jwt/types.rs
    api_key: Arc<ApiKeyHandler>, // src/auth/api_key/creation.rs
    rbac: Arc<RbacSystem>,       // src/auth/rbac/system.rs
}

RequestIdMiddleware -> AuditMiddleware -> IpAccessMiddleware -> CORS/Metrics
  -> AuthMiddleware            (src/server/middleware/auth.rs)
  -> RateLimitMiddleware       (src/server/middleware/rate_limit.rs)
  -> SecurityHeadersMiddleware -> handler

// src/utils/auth/crypto/keys.rs
pub fn generate_api_key() -> String;                       // "gw-" + 32 alphanumerics
pub fn hash_api_key(api_key: &str, hmac_secret: Option<&str>) -> String;
pub fn extract_api_key_prefix(api_key: &str) -> String;    // "gw-a...mnop" display only

impl ApiKeyHandler {
    pub async fn create_key(&self, user_id: Option<Uuid>, team_id: Option<Uuid>,
        name: String, permissions: Vec<String>) -> Result<(ApiKey, String)>; // (stored, raw)
    pub async fn verify_key(&self, raw_key: &str) -> Result<Option<(ApiKey, Option<User>)>>;
    pub async fn verify_key_detailed(&self, raw_key: &str) -> Result<ApiKeyVerification>;
}

pub struct Claims {
    pub sub: Uuid,                  // user ID
    pub iat: u64, pub exp: u64,
    pub iss: String,                // fixed "litellm-rs"
    pub aud: String,                // "api" for access, "refresh" for refresh tokens
    pub jti: String,                // UUID token ID
    pub role: String,
    pub permissions: Vec<String>,
    pub team_id: Option<Uuid>,
    pub session_id: Option<String>,
    pub token_type: TokenType,      // Access | Refresh | PasswordReset |
}                                   // EmailVerification | Invitation

impl JwtHandler {
    pub async fn create_access_token(&self, user_id: Uuid, role: String,
        permissions: Vec<String>, team_id: Option<Uuid>, session_id: Option<Uuid>)
        -> Result<String>;
    pub async fn create_refresh_token(&self, user_id: Uuid,
        session_id: Option<String>) -> Result<String>;      // exp = expiration * 24
    pub async fn create_token_pair(...) -> Result<TokenPair>;
    pub async fn verify_access_token(&self, token: &str) -> Result<Claims>;
    pub async fn verify_refresh_token(&self, token: &str) -> Result<Uuid>;
}

© majiayu000, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 6 other files in .claude/skills/auth-architecture of majiayu000/litellm-rs.

• SKILL.md
• reference/configuration.md
• reference/error-types.md
• reference/middleware-pipeline.md
• reference/rate-limiting.md
• reference/rbac.md
• reference/security-best-practices.md

Open the folder on GitHubat commit ed3f4d9