[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FG2QAG8A5DRWMSZGMRGPZ2":3,"skill-same:01M6FG2QAG8A5DRWMSZGMRGPZ2":83},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":54,"commitSha":55,"skillDirectory":56,"forksCount":57,"repositoryHtmlUrl":58,"repositoryHomepageUrl":59,"ownerHtmlUrl":60,"ownerBlogUrl":6,"ownerDescription":61,"updatedAt":62,"install":63,"resources":76},"01M6FG2QAG8A5DRWMSZGMRGPZ2","api-authentication",null,"Secure API authentication with JWT, OAuth 2.0, API keys. Use for authentication systems, third-party integrations, service-to-service communication, or encountering token management, security headers, auth flow errors.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fsecondsky\u002Fclaude-skills\u002Fapi-authentication\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"api authentication","authentication","api","management","errors","headers","with","systems","service","third-party","token","use","security","integrations","jwt","OAuth","flow","communication","secure","auth","2026-11-10 10:12:30",false,"---\nname: api-authentication\ndescription: Secure API authentication with JWT, OAuth 2.0, API keys. Use for authentication systems, third-party integrations, service-to-service communication, or encountering token management, security headers, auth flow errors.\nlicense: MIT\n---\n\n# API Authentication\n\nImplement secure authentication mechanisms for APIs using modern standards and best practices.\n\n## Authentication Methods\n\n| Method | Use Case | Security Level |\n|--------|----------|----------------|\n| JWT | Stateless auth, SPAs | High |\n| OAuth 2.0 | Third-party integration | High |\n| API Keys | Service-to-service | Medium |\n| Session | Traditional web apps | High |\n\n## JWT Implementation (Node.js)\n\n```javascript\nconst jwt = require('jsonwebtoken');\n\nconst generateTokens = (user) => ({\n  accessToken: jwt.sign(\n    { userId: user.id, role: user.role },\n    process.env.JWT_SECRET,\n    { expiresIn: '15m' }\n  ),\n  refreshToken: jwt.sign(\n    { userId: user.id, type: 'refresh' },\n    process.env.REFRESH_SECRET,\n    { expiresIn: '7d' }\n  )\n});\n\nconst authMiddleware = (req, res, next) => {\n  const authHeader = req.headers.authorization;\n\n  \u002F\u002F Validate authorization header format\n  if (!authHeader || !authHeader.startsWith('Bearer ')) {\n    return res.status(401).json({ error: 'Malformed authorization header' });\n  }\n\n  const parts = authHeader.split(' ');\n  if (parts.length !== 2) {\n    return res.status(401).json({ error: 'Malformed authorization header' });\n  }\n\n  const token = parts[1];\n  if (!token) {\n    return res.status(401).json({ error: 'No token provided' });\n  }\n\n  try {\n    req.user = jwt.verify(token, process.env.JWT_SECRET);\n    next();\n  } catch (err) {\n    res.status(401).json({ error: 'Invalid token' });\n  }\n};\n```\n\n## Security Requirements\n\n- Always use HTTPS\n- Store tokens in HttpOnly cookies (not localStorage)\n- Hash passwords with bcrypt (cost factor 12+)\n- Implement rate limiting on auth endpoints\n- Rotate secrets regularly\n- Never transmit tokens in URLs\n\n## Security Headers\n\n```javascript\napp.use((req, res, next) => {\n  res.setHeader('X-Content-Type-Options', 'nosniff');\n  res.setHeader('X-Frame-Options', 'DENY');\n  res.setHeader('Strict-Transport-Security', 'max-age=31536000');\n  next();\n});\n```\n\n## Additional Implementations\n\nSee [references\u002Fpython-flask.md](references\u002Fpython-flask.md) for:\n- Flask JWT with role-based access control decorators\n- OAuth 2.0 Google integration with Authlib\n- API key authentication with secure hashing\n\n## Common Mistakes to Avoid\n\n- Storing plain-text passwords\n- Using weak JWT secrets\n- Ignoring token expiration\n- Disabling HTTPS in production\n- Logging sensitive tokens\n","# API Authentication\n\nImplement secure authentication mechanisms for APIs using modern standards and best practices.\n\n## Authentication Methods\n\n| Method | Use Case | Security Level |\n|--------|----------|----------------|\n| JWT | Stateless auth, SPAs | High |\n| OAuth 2.0 | Third-party integration | High |\n| API Keys | Service-to-service | Medium |\n| Session | Traditional web apps | High |\n\n## JWT Implementation (Node.js)\n\n```javascript\nconst jwt = require('jsonwebtoken');\n\nconst generateTokens = (user) => ({\n  accessToken: jwt.sign(\n    { userId: user.id, role: user.role },\n    process.env.JWT_SECRET,\n    { expiresIn: '15m' }\n  ),\n  refreshToken: jwt.sign(\n    { userId: user.id, type: 'refresh' },\n    process.env.REFRESH_SECRET,\n    { expiresIn: '7d' }\n  )\n});\n\nconst authMiddleware = (req, res, next) => {\n  const authHeader = req.headers.authorization;\n\n  \u002F\u002F Validate authorization header format\n  if (!authHeader || !authHeader.startsWith('Bearer ')) {\n    return res.status(401).json({ error: 'Malformed authorization header' });\n  }\n\n  const parts = authHeader.split(' ');\n  if (parts.length !== 2) {\n    return res.status(401).json({ error: 'Malformed authorization header' });\n  }\n\n  const token = parts[1];\n  if (!token) {\n    return res.status(401).json({ error: 'No token provided' });\n  }\n\n  try {\n    req.user = jwt.verify(token, process.env.JWT_SECRET);\n    next();\n  } catch (err) {\n    res.status(401).json({ error: 'Invalid token' });\n  }\n};\n```\n\n## Security Requirements\n\n- Always use HTTPS\n- Store tokens in HttpOnly cookies (not localStorage)\n- Hash passwords with bcrypt (cost factor 12+)\n- Implement rate limiting on auth endpoints\n- Rotate secrets regularly\n- Never transmit tokens in URLs\n\n## Security Headers\n\n```javascript\napp.use((req, res, next) => {\n  res.setHeader('X-Content-Type-Options', 'nosniff');\n  res.setHeader('X-Frame-Options', 'DENY');\n  res.setHeader('Strict-Transport-Security', 'max-age=31536000');\n  next();\n});\n```\n\n## Additional Implementations\n\nSee [references\u002Fpython-flask.md](references\u002Fpython-flask.md) for:\n- Flask JWT with role-based access control decorators\n- OAuth 2.0 Google integration with Authlib\n- API key authentication with secure hashing\n\n## Common Mistakes to Avoid\n\n- Storing plain-text passwords\n- Using weak JWT secrets\n- Ignoring token expiration\n- Disabling HTTPS in production\n- Logging sensitive tokens\n",{"name":5,"license":15,"description":7},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Fsecondsky\u002Fclaude-skills\u002Fapi-authentication",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":75},[65,68,71],{"tool":66,"command":67},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill api-authentication",{"tool":69,"command":70},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill api-authentication",{"tool":72,"command":73},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill api-authentication","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fsecondsky\u002Fclaude-skills\u002Fapi-authentication\u002FSKILL.md",true,[77],{"path":78,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fpython-flask.md","REFERENCE","参考文档",6635,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fsecondsky\u002Fclaude-skills\u002Fapi-authentication\u002Freferences\u002Fpython-flask.md",[84,96,106,115,121,128],{"skillNo":85,"name":86,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":92,"publishedAt":49},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[89],{"categoryNo":90,"categoryName":91,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[93,94,95],"model","model hierarchy","model hierarchy skill",{"skillNo":97,"name":98,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":102,"publishedAt":49},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[101],{"categoryNo":90,"categoryName":91,"taxonomyType":21,"taxonomyTypeDesc":22},[103,104,105],"MCP","zoom","zoom mcp",{"skillNo":107,"name":108,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":49},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[112,113,114,104],"sdk","zoom apps sdk","apps",{"skillNo":116,"name":117,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":49},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[117],{"skillNo":122,"name":123,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":127,"publishedAt":49},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[126],{"categoryNo":90,"categoryName":91,"taxonomyType":21,"taxonomyTypeDesc":22},[123],{"skillNo":129,"name":130,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":49},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[130]]