New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Configuring Oauth2 Authorization Flow

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implementation, token…

Apache-2.0Auto-check passedBackend & APIs

Install Configuring Oauth2 Authorization Flow

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-oauth2-authorization-flow -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills configuring-oauth2-authorization-flow --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/configuring-oauth2-authorization-flow .claude/skills/configuring-oauth2-authorization-flow && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
configuring-oauth2-authorization-flow
GitHub stars
34k
Token cost
~1.7k tokens
SKILL.md length
659 words
Files
8 (incl. scripts, references, assets)
Skills in repo
637
Repo updated
First seen
Licence
Apache-2.0

At a glance

Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implementation, token…

  • Works in 5 steps: Authorization Code Flow with PKCE → Scope Design → Token Security → …
  • Hardening OAuth 2.0 authentication/authorization for web
  • SKILL.md covers Overview, When to Use, Prerequisites and Objectives, plus 5 more sections
  • Runs Python scripts from its folder

What it does

Configuring Oauth2 Authorization Flow is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implementation, token lifecycle management, and scope design per OAuth 2.1. Use when implementing or hardening OAuth 2.0 authentication/authorization for web, mobile, SPA, or machine-to-machine clients.

Its SKILL.md is about 1.7k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Backend & APIs, covering OAuth and OpenID Connect and Authorization and RBAC. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Hardening OAuth 2.0 authentication/authorization for web
  • Machine-to-machine clients

Example prompts

  • “Use the configuring-oauth2-authorization-flow skill to configure secure OAuth 2.0 authorization flows, including Authorization Code with PKCE…”
  • “/configuring-oauth2-authorization-flow”

Requirements

  • Python 3

Workflow steps

5 steps, taken from the step headings in SKILL.md.

  1. Authorization Code Flow with PKCE
  2. Scope Design
  3. Token Security
  4. Client Credentials Flow
  5. Security Hardening

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Configuring Oauth2 Authorization Flow loads about 1.7k tokens when it runs, and up to ~4k if it reads all its reference files. Until then it costs about 103 tokens; SKILL.md has 659 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~103
When it runs · the whole SKILL.md, loaded when a task matches
~1.7k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 659 words, ~1,703 tokens.

Download SKILL.mdSave it as .claude/skills/configuring-oauth2-authorization-flow/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
configuring-oauth2-authorization-flow
description
Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implementation, token lifecycle management, and scope design per OAuth 2.1. Use when implementing or hardening OAuth 2.0 authentication/authorization for web, mobile, SPA, or machine-to-machine clients.
domain
cybersecurity
subdomain
identity-access-management
tags
iam, identity, access-control, authentication, authorization, oauth2, oidc, pkce
version
1.0
author
mahipal
license
Apache-2.0
nist_csf
PR.AA-01, PR.AA-02, PR.AA-05, PR.AA-06
mitre_attack
T1528, T1550.001, T1539, T1606.001, T1212
mitre_f3.version
1.1
mitre_f3.tactics
initial-access, positioning

Configuring OAuth 2.0 Authorization Flow

Overview

Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token lifecycle management, scope design, and alignment with OAuth 2.1 security requirements.

When to Use

  • When deploying or configuring configuring oauth2 authorization flow capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • Familiarity with identity access management concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Objectives

  • Implement Authorization Code flow with PKCE for public and confidential clients
  • Configure Client Credentials flow for machine-to-machine communication
  • Design least-privilege scope hierarchies
  • Implement secure token storage, refresh, and revocation
  • Apply OAuth 2.1 best practices and RFC 9700 security recommendations
  • Validate token integrity and prevent common OAuth attacks

Key Concepts

OAuth 2.0 Grant Types
  1. Authorization Code + PKCE: Recommended for all client types (web, mobile, SPA). PKCE is mandatory in OAuth 2.1.
  2. Client Credentials: Machine-to-machine authentication without user context.
  3. Device Authorization Grant (RFC 8628): For input-constrained devices (smart TVs, CLI tools).
  4. Refresh Token: Long-lived token to obtain new access tokens without re-authentication.
PKCE (Proof Key for Code Exchange)

PKCE (RFC 7636) prevents authorization code interception attacks:

  1. Client generates random code_verifier (43-128 characters, unreserved URI chars)
  2. Client computes code_challenge = BASE64URL(SHA256(code_verifier))
  3. Authorization request includes code_challenge and code_challenge_method=S256
  4. Token request includes original code_verifier
  5. Server validates SHA256(code_verifier) matches stored code_challenge
Token Types
  • Access Token: Short-lived (5-60 min), bearer or DPoP-bound
  • Refresh Token: Long-lived, single-use with rotation
  • ID Token (OIDC): JWT containing user identity claims

Workflow

Step 1: Authorization Code Flow with PKCE
  1. Generate cryptographically random code_verifier (min 43 chars)
  2. Compute code_challenge using S256 method
  3. Redirect user to authorization endpoint with parameters:
    • response_type=code
    • client_id, redirect_uri, scope, state
    • code_challenge, code_challenge_method=S256
  4. User authenticates and consents
  5. Authorization server redirects with authorization code
  6. Exchange code + code_verifier for tokens at token endpoint
  7. Validate state parameter matches original value
Step 2: Scope Design
  • Define granular scopes: read:users, write:orders, admin:settings
  • Follow least-privilege: request minimum scopes needed
  • Implement scope validation on resource server
  • Document scope hierarchy and consent requirements
Show full SKILL.md (275 more words)Show less
Step 3: Token Security
  • Store tokens securely (httpOnly cookies for web, keychain for mobile)
  • Implement token refresh with rotation (one-time-use refresh tokens)
  • Set appropriate expiration: access tokens 5-15 min, refresh tokens 8-24 hrs
  • Enable DPoP (Demonstration of Proof-of-Possession) for sender-constrained tokens
  • Implement token revocation endpoint
Step 4: Client Credentials Flow
  1. Register service client with client_id and client_secret
  2. Request token: POST /oauth/token with grant_type=client_credentials
  3. Include scope for required permissions
  4. Store client_secret securely (vault, env vars, not code)
  5. Implement certificate-based client authentication for higher assurance
Step 5: Security Hardening
  • Enforce PKCE for all authorization code flows
  • Use exact redirect URI matching (no wildcards)
  • Implement CSRF protection with state parameter
  • Enable refresh token rotation and revocation on reuse detection
  • Apply RFC 9700 security best practices
  • Block implicit grant and ROPC (removed in OAuth 2.1)

Security Controls

ControlNIST 800-53Description
Access ControlAC-3Token-based access enforcement
AuthenticationIA-5Client credential management
Session ManagementSC-23Token lifecycle management
AuditAU-3Log all token issuance and revocation
Cryptographic ProtectionSC-13PKCE and token signing

Common Pitfalls

  • Using implicit grant (removed in OAuth 2.1) instead of authorization code + PKCE
  • Storing tokens in localStorage (XSS vulnerable) instead of httpOnly cookies
  • Not validating state parameter enabling CSRF attacks
  • Using wildcard redirect URIs allowing open redirect exploitation
  • Not implementing refresh token rotation allowing token theft persistence

Verification

  • Authorization Code + PKCE flow completes successfully
  • PKCE code_challenge validated at token endpoint
  • State parameter prevents CSRF
  • Access tokens expire within configured lifetime
  • Refresh token rotation issues new refresh token each use
  • Token revocation invalidates both access and refresh tokens
  • Client Credentials flow works for service-to-service calls
  • Scopes correctly enforced at resource server

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/configuring-oauth2-authorization-flow of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Configuring Oauth2 Authorization Flow next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Configuring Oauth2 Authorization Flow compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Configuring Oauth2 Authorization Flow this skillmukul975/Anthropic-Cybersecurity-Skills34k—~1.7kAutomated safety check: PassApache-2.0
Cognitoitsmostafa/aws-agent-skills1.2k1 repos~2.3kAutomated safety check: PassMIT
Auth Implementation Patternsynulihao/AgentSkillOS61710 repos~4.4kAutomated safety check: PassNone
Soundcloud API Authsoundcloud/api258—~562Automated safety check: PassNone
Frontmcp Auth UIagentfront/frontmcp146—~3.7kAutomated safety check: PassApache-2.0
Supercheck Security Authsupercheck-io/supercheck215—~1.2kAutomated safety check: PassAGPL-3.0

Similar skills

  • Cognito

    itsmostafa/aws-agent-skills

    AWS Cognito user authentication and authorization service. An agent skill from itsmostafa/aws-agent-skills.

    1.2k GitHub starsUsed in 1 repo~2.3k tokens
    Backend & APIsAuto-check passed

  • Auth Implementation Patterns

    ynulihao/AgentSkillOS

    Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems.

    617 GitHub starsUsed in 10 repos~4.4k tokens
    Backend & APIsAuto-check passed

  • Soundcloud API Auth

    soundcloud/api

    Implements SoundCloud OAuth 2.1 flows — Authorization Code with PKCE and Client Credentials — including token refresh and secure credential storage.

    258 GitHub stars~562 tokensUpdated 8 days ago
    Backend & APIsAuto-check passed

  • Frontmcp Auth UI

    agentfront/frontmcp

    A skill your agent uses when customizing, branding, or replacing the built-in FrontMCP OAuth pages (the login, consent, federated-select, incremental-authorization, and error pages) with your own…

    146 GitHub stars~3.7k tokensUpdated yesterday
    Backend & APIsAuto-check passed

  • Supercheck Security Auth

    supercheck-io/supercheck

    Work on Supercheck authentication, RBAC, tenant isolation, sessions, API and trigger keys, invitations, project membership, project variables, OAuth, super-admin behavior, SSRF, or…

    215 GitHub stars~1.2k tokensUpdated yesterday
    Backend & APIsAuto-check passed

  • Authentication

    codewithmukesh/dotnet-claude-kit

    Authentication and authorization for ASP.NET Core. An agent skill from codewithmukesh/dotnet-claude-kit.

    751 GitHub starsUsed in 1 repo~1.9k tokens
    Backend & APIsAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 637 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Configuring Oauth2 Authorization Flow

What does Configuring Oauth2 Authorization Flow do?

Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implementation, token…. Configuring Oauth2 Authorization Flow is an agent skill from mukul975/Anthropic-Cybersecurity-Skills.1.

When should I use Configuring Oauth2 Authorization Flow?

Configuring Oauth2 Authorization Flow fits situations like: hardening OAuth 2.0 authentication/authorization for web; machine-to-machine clients.

How do I install Configuring Oauth2 Authorization Flow in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-oauth2-authorization-flow -a claude-code`. Or copy the skill folder (skills/configuring-oauth2-authorization-flow in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/configuring-oauth2-authorization-flow in your project. Claude Code loads it when a task matches its description.

How do I install Configuring Oauth2 Authorization Flow in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-oauth2-authorization-flow -a codex`. Or copy the skill folder (skills/configuring-oauth2-authorization-flow in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/configuring-oauth2-authorization-flow in your project. Codex loads it when a task matches its description.

Can I use Configuring Oauth2 Authorization Flow in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-oauth2-authorization-flow -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/configuring-oauth2-authorization-flow, .gemini/skills/configuring-oauth2-authorization-flow, .github/skills/configuring-oauth2-authorization-flow and .opencode/skills/configuring-oauth2-authorization-flow in your project.

What does Configuring Oauth2 Authorization Flow need to run?

Going by SKILL.md and its folder, Configuring Oauth2 Authorization Flow needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Configuring Oauth2 Authorization Flow access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Configuring Oauth2 Authorization Flow safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Configuring Oauth2 Authorization Flow use?

Configuring Oauth2 Authorization Flow is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Configuring Oauth2 Authorization Flow use?

About 1.7k tokens (SKILL.md is roughly 6.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.3k tokens, read only when the agent opens those files.

What are the alternatives to Configuring Oauth2 Authorization Flow?

Skills that share tags, products or a category with Configuring Oauth2 Authorization Flow: Cognito (itsmostafa/aws-agent-skills, 1.2k stars), Auth Implementation Patterns (ynulihao/AgentSkillOS, 617 stars), Soundcloud API Auth (soundcloud/api, 258 stars) and Frontmcp Auth UI (agentfront/frontmcp, 146 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Configuring Oauth2 Authorization Flow?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 33,922 GitHub stars. The repository holds 637 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.