Supabase Development and Debugging
supabase/agent-skills
General Supabase skill for database, auth, Edge Functions, Realtime and storage work, plus client libraries, migrations, security audits, debugging and reading logs.
Authentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mistakes.
Install Authentication Patterns
$ npx skills add zebbern/claude-code-guide --skill authentication-patterns -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install zebbern/claude-code-guide authentication-patterns --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/zebbern/claude-code-guide.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/authentication-patterns .claude/skills/authentication-patterns && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "authentication-patterns" agent skill from https://github.com/zebbern/claude-code-guide/tree/main/skills/authentication-patterns into .claude/skills/authentication-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "authentication-patterns", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/zebbern/claude-code-guide/tree/main/skills/authentication-patternsType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add zebbern/claude-code-guide --skill authentication-patterns -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install zebbern/claude-code-guide authentication-patterns --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zebbern/claude-code-guide.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/authentication-patterns .agents/skills/authentication-patterns && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "authentication-patterns" agent skill from https://github.com/zebbern/claude-code-guide/tree/main/skills/authentication-patterns into .agents/skills/authentication-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "authentication-patterns", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zebbern/claude-code-guide --skill authentication-patterns -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install zebbern/claude-code-guide authentication-patterns --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zebbern/claude-code-guide.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/authentication-patterns .cursor/skills/authentication-patterns && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "authentication-patterns" agent skill from https://github.com/zebbern/claude-code-guide/tree/main/skills/authentication-patterns into .cursor/skills/authentication-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "authentication-patterns", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/zebbern/claude-code-guide.git --path skills/authentication-patterns--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add zebbern/claude-code-guide --skill authentication-patterns -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install zebbern/claude-code-guide authentication-patterns --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zebbern/claude-code-guide.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/authentication-patterns .gemini/skills/authentication-patterns && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "authentication-patterns" agent skill from https://github.com/zebbern/claude-code-guide/tree/main/skills/authentication-patterns into .gemini/skills/authentication-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "authentication-patterns", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install zebbern/claude-code-guide authentication-patternsInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add zebbern/claude-code-guide --skill authentication-patterns -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/zebbern/claude-code-guide.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/authentication-patterns .github/skills/authentication-patterns && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "authentication-patterns" agent skill from https://github.com/zebbern/claude-code-guide/tree/main/skills/authentication-patterns into .github/skills/authentication-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "authentication-patterns", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zebbern/claude-code-guide --skill authentication-patterns -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install zebbern/claude-code-guide authentication-patterns --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zebbern/claude-code-guide.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/authentication-patterns .opencode/skills/authentication-patterns && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "authentication-patterns" agent skill from https://github.com/zebbern/claude-code-guide/tree/main/skills/authentication-patterns into .opencode/skills/authentication-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "authentication-patterns", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
authentication-patterns- GitHub stars
- 4.6k
- Token cost
- ~2k tokens
- SKILL.md length
- 748 words
- Files
- 1
- Skills in repo
- 46
- Repo updated
- First seen
- Licence
- MIT
At a glance
Authentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mistakes.
- Implementing auth
- SKILL.md covers WHEN_TO_USE, AUTH_APPROACHES, JWT_BEST_PRACTICES and PROVIDER_PATTERNS, plus 2 more sections
- Needs GITHUB_CLIENT_SECRET
- Reviewing auth flows
What it does
Authentication Patterns is an agent skill from zebbern/claude-code-guide. Authentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mistakes. Use when implementing auth, reviewing auth flows, or choosing auth providers.
Its SKILL.md is about 2k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Backend & APIs, covering Authentication and Security review. It works with Supabase. The repository describes itself as: Claude Code Guide - Setup, Commands, workflows, agents, skills & tips-n-tricks from beginner to power user! The licence is MIT.
When your agent uses it
- Implementing auth
- Reviewing auth flows
- Choosing auth providers
Example prompts
- “/authentication-patterns”
Requirements
- A credential in GITHUB_CLIENT_SECRET
What it can do on your machine
Read from SKILL.md and the folder at commit 4698e3b. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are typescript).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
GITHUB_CLIENT_SECRET
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Authentication Patterns loads about 2k tokens when it runs. Until then it costs about 64 tokens; SKILL.md has 748 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from zebbern/claude-code-guide at commit 4698e3b, republished under its MIT licence (© zebbern). 748 words, ~2,013 tokens.
Download SKILL.mdSave it as
.claude/skills/authentication-patterns/SKILL.md (or your agent's skills folder).- name
- authentication-patterns
- description
- Authentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mistakes. Use when implementing auth, reviewing auth flows, or choosing auth providers.
Authentication Patterns Skill
Reference for implementing secure, production-ready authentication.
WHEN_TO_USE
Apply this skill when implementing authentication in a project, reviewing existing auth flows for security issues, choosing between auth providers, or migrating between auth strategies. Use the security checklist before shipping any auth-related change.
AUTH_APPROACHES
| Approach | How It Works | Best For | Drawbacks |
|---|---|---|---|
| Session-based | Server stores session in DB/Redis, client holds session ID cookie | Traditional server-rendered apps, apps needing instant revocation | Requires server-side storage, harder to scale horizontally without shared store |
| JWT (stateless) | Server signs token, client sends it on each request | API-first apps, microservices, mobile clients | Cannot revoke without blocklist, token size grows with claims |
| OAuth 2.0 / OIDC | Delegates auth to external provider (Google, GitHub, etc.) | Social login, enterprise SSO, reducing auth responsibility | More complex flow, depends on external provider availability |
| Passkeys / WebAuthn | Cryptographic key pair, no passwords | High-security apps, passwordless UX | Limited browser support legacy, user education needed |
Decision Guide
- Server-rendered app with simple needs → Session-based
- SPA or mobile app calling APIs → JWT with refresh token rotation
- Want social login or SSO → OAuth 2.0 / OIDC
- Greenfield with modern UX goals → Passkeys + OAuth fallback
JWT_BEST_PRACTICES
Token Lifecycle
Login → Access Token (short-lived) + Refresh Token (long-lived, rotated)
│
├─ Access Token: 15 min expiry, sent via httpOnly cookie or Authorization header
│
└─ Refresh Token: 7-30 day expiry, stored in httpOnly secure cookie
│
└─ On use: issue new access + new refresh token, invalidate old refresh tokenRules
- [P0-MUST] Set short expiry on access tokens (15 minutes or less).
- [P0-MUST] Store tokens in
httpOnly,Secure,SameSite=Laxcookies — never inlocalStorageorsessionStorage. - [P0-MUST] Implement refresh token rotation — each refresh token is single-use.
- [P0-MUST] Maintain a server-side blocklist for revoked refresh tokens.
- [P1-SHOULD] Include only essential claims in JWT payload (sub, iat, exp, role). Keep it small.
- [P1-SHOULD] Use asymmetric signing (RS256 or ES256) for distributed systems; symmetric (HS256) for single-service only.
- [P1-SHOULD] Validate
iss,aud, andexpclaims on every request. - [P2-MAY] Use JWE (encrypted JWT) when token payload contains sensitive data.
Token Storage Comparison
| Storage | XSS Safe | CSRF Safe | Recommendation |
|---|---|---|---|
httpOnly cookie | Yes | No (needs CSRF token) | Recommended |
localStorage | No | Yes | Never use for auth tokens |
sessionStorage | No | Yes | Never use for auth tokens |
| In-memory (JS variable) | Yes | Yes | OK for SPAs, lost on refresh |
PROVIDER_PATTERNS
Comparison
| Provider | Type | Best For | Pricing | Key Features |
|---|---|---|---|---|
| NextAuth / Auth.js | OSS library | Next.js apps wanting full control | Free | 80+ providers, DB adapters, self-hosted |
| Clerk | Managed service | Fast launch, pre-built UI, user management | Free tier, then per-MAU | Drop-in components, user dashboard, org support |
| Supabase Auth | Managed (part of Supabase) | Apps already using Supabase for DB/storage | Free tier, then per-MAU | Row-level security integration, magic links, SSO |
| Lucia | OSS library | Full control, minimal abstraction | Free | Session-based, framework-agnostic, type-safe |
When to Use Each
- NextAuth / Auth.js: You want provider flexibility, self-hosting, and database session control. Best when you need custom flows.
- Clerk: You want auth done fast with pre-built UI components. Best for MVPs and teams that don't want to build auth UI.
- Supabase Auth: You're already using Supabase. Auth integrates with RLS policies for row-level security.
- Lucia: You want a minimal, type-safe session library without framework lock-in.
Show full SKILL.md (278 more words)Show less
NextAuth.js Setup Pattern
// app/api/auth/[...nextauth]/route.ts
import NextAuth from "next-auth";
import GitHub from "next-auth/providers/github";
import { PrismaAdapter } from "@auth/prisma-adapter";
import { prisma } from "@/lib/prisma";
export const { handlers, auth, signIn, signOut } = NextAuth({
adapter: PrismaAdapter(prisma),
providers: [
GitHub({
clientId: process.env.GITHUB_CLIENT_ID!,
clientSecret: process.env.GITHUB_CLIENT_SECRET!,
}),
],
callbacks: {
session({ session, user }) {
session.user.id = user.id;
return session;
},
},
});SECURITY_CHECKLIST
Before Shipping Auth
- Rate limiting: Login endpoint limited to 5-10 attempts per minute per IP.
- CSRF protection: Anti-CSRF tokens on all state-changing requests (or use
SameSite=Laxcookies). - Password hashing: Using bcrypt (cost 12+) or argon2id — never MD5, SHA-1, or plain SHA-256.
- HTTPS only: All auth endpoints served over TLS. Cookies have
Secureflag. - Input validation: Email format, password length (min 8, max 128), no SQL/NoSQL injection vectors.
- Account enumeration: Login and registration return the same response whether account exists or not.
- Session invalidation: Logout invalidates server-side session/refresh token, not just client cookie.
- MFA support: TOTP (authenticator app) or WebAuthn as second factor for sensitive accounts.
- Password reset: Time-limited tokens (1 hour), single-use, sent over secure channel.
- Audit logging: Log auth events (login, logout, failed attempts, password changes) with timestamp and IP.
Password Hashing
// Using bcrypt
import bcrypt from "bcrypt";
const SALT_ROUNDS = 12;
async function hashPassword(password: string): Promise<string> {
return bcrypt.hash(password, SALT_ROUNDS);
}
async function verifyPassword(password: string, hash: string): Promise<boolean> {
return bcrypt.compare(password, hash);
}// Using argon2 (preferred for new projects)
import argon2 from "argon2";
async function hashPassword(password: string): Promise<string> {
return argon2.hash(password, { type: argon2.argon2id });
}
async function verifyPassword(hash: string, password: string): Promise<boolean> {
return argon2.verify(hash, password);
}COMMON_MISTAKES
| Mistake | Risk | Fix |
|---|---|---|
Storing JWT in localStorage | XSS can steal tokens | Use httpOnly cookies |
| Long-lived JWTs (days/weeks) | Stolen token is valid for extended period | 15 min access token + refresh rotation |
| Missing CSRF protection | Attackers can forge requests from other sites | SameSite=Lax cookies + CSRF token |
| Weak password requirements | Brute force and credential stuffing | Min 8 chars, check against breached password lists |
| Exposing user existence on login | Account enumeration | Generic "Invalid credentials" message |
| Not rotating refresh tokens | Stolen refresh token grants indefinite access | Single-use refresh tokens with rotation |
| Hardcoding secrets in source | Credential leak via git history | Use environment variables, never commit secrets |
| Missing rate limiting on login | Brute force attacks | 5-10 attempts/min per IP, exponential backoff |
| Rolling your own crypto | Subtle vulnerabilities | Use established libraries (bcrypt, argon2, jose) |
| Not validating JWT claims | Token misuse across services | Always verify iss, aud, exp |
© zebbern, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/authentication-patterns of zebbern/claude-code-guide.
Open the folder on GitHubat commit 4698e3b
Compare with similar skills
Authentication Patterns next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Authentication Patterns this skillzebbern/claude-code-guide | 4.6k | — | ~2k | Automated safety check: Pass | MIT | |
| Supabase Development and Debuggingsupabase/agent-skills | 2.7k | 3 repos | ~3.6k | Automated safety check: Pass | MIT | |
| Supabasecurvenote/curvenote | 169 | 5 repos | ~2.2k | Automated safety check: Pass | Custom licence | |
| Security Reviewjewbetcha/opentrace | 116 | 17 repos | ~3.1k | Automated safety check: Notes | MIT | |
| Security Reviewxu-xiang/everything-claude-code-zh | 2k | — | ~2.5k | Automated safety check: Notes | MIT | |
| Security Reviewxu-xiang/everything-claude-code-zh | 2k | — | ~2.4k | Automated safety check: Notes | MIT |
Similar skills
- Official
Supabase
curvenote/curvenote
A skill your agent uses when doing ANY task involving Supabase.
Security Review
jewbetcha/opentrace
A skill your agent uses when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features.
Security Review
xu-xiang/everything-claude-code-zh
当涉及添加身份验证（Authentication）、处理用户输入、操作机密（Secrets）、创建 API 终端节点或实现支付/敏感功能时，请使用此技能。提供全面的安全检查清单和模式。
Security Review
xu-xiang/everything-claude-code-zh
在添加身份验证、处理用户输入、操作机密信息、创建 API 接口或实现支付/敏感功能时使用此技能。提供全面的安全自查清单和模式。
Security Review
doorkeeper-gem/doorkeeper
Verify that code changes do not introduce OAuth security vulnerabilities.
More from zebbern/claude-code-guide
All 46 skills in this repoLocalization Toolkit
zebbern/claude-code-guide
This skill should be used when setting up, auditing, or enforcing internationalization/localization in UI codebases (React/TS, i18next or similar, JSON locales), including installing/configuring the…
Audit Flow
zebbern/claude-code-guide
Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export.
Chart Image
zebbern/claude-code-guide
Generate publication-quality PNG chart images from data, supporting line, bar, area, candlestick, pie, and heatmap charts.
Code To Diagram
zebbern/claude-code-guide
Analyze codebases and automatically generate architecture diagrams, flowcharts, and org charts.
Code Vuln Audit
zebbern/claude-code-guide
Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection.
Data Viz Renderer
zebbern/claude-code-guide
Generate self-contained HTML/SVG infographics from JSON data, including stat cards, bar charts, flow diagrams, and mixed dashboards.
Related
Works with
Categories
Questions about Authentication Patterns
What does Authentication Patterns do?
Authentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mistakes. Authentication Patterns is an agent skill from zebbern/claude-code-guide. Authentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mistakes.
When should I use Authentication Patterns?
Authentication Patterns fits situations like: implementing auth; reviewing auth flows; choosing auth providers.
How do I install Authentication Patterns in Claude Code?
Run `npx skills add zebbern/claude-code-guide --skill authentication-patterns -a claude-code`. Or copy the skill folder (skills/authentication-patterns in zebbern/claude-code-guide) into .claude/skills/authentication-patterns in your project. Claude Code loads it when a task matches its description.
How do I install Authentication Patterns in Codex?
Run `npx skills add zebbern/claude-code-guide --skill authentication-patterns -a codex`. Or copy the skill folder (skills/authentication-patterns in zebbern/claude-code-guide) into .agents/skills/authentication-patterns in your project. Codex loads it when a task matches its description.
Can I use Authentication Patterns in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add zebbern/claude-code-guide --skill authentication-patterns -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/authentication-patterns, .gemini/skills/authentication-patterns, .github/skills/authentication-patterns and .opencode/skills/authentication-patterns in your project.
What does Authentication Patterns need to run?
Going by SKILL.md and its folder, Authentication Patterns needs credentials named GITHUB_CLIENT_SECRET. Our summary lists: A credential in GITHUB_CLIENT_SECRET.
Does Authentication Patterns access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Authentication Patterns safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Authentication Patterns use?
Authentication Patterns is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Authentication Patterns use?
About 2k tokens (SKILL.md is roughly 8.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Authentication Patterns?
Skills that share tags, products or a category with Authentication Patterns: Supabase Development and Debugging (supabase/agent-skills, 2.7k stars), Supabase (curvenote/curvenote, 169 stars), Security Review (jewbetcha/opentrace, 116 stars) and Security Review (xu-xiang/everything-claude-code-zh, 2k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Authentication Patterns?
zebbern (a GitHub user) maintains it in zebbern/claude-code-guide, which has 4,648 GitHub stars. The repository holds 46 skills in this directory. The repository was last updated on October 7, 2026.
Source: zebbern/claude-code-guide on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.