Auth Flow Designer Protocol

This skill designs the authentication and authorization strategy for an API. It prevents developers from defaulting to "Just use JWTs for everything," ensuring the right security model is applied based on the consumers and the data sensitivity.

Core assumption: A leaked token is inevitable. The architecture must minimize the damage through short lifespans, refresh flows, and tight scopes.

0. Context Intake

Before designing, make sure you have the inputs below. Read the previous workflow step's artifact first if it exists. Ask only for what is missing, in a single message, and state any assumption you make instead of blocking.

• Client types: browser SPA, mobile app, server-to-server, third-party integrators, AI agents.
• Identity provider in use or allowed (Auth0, Cognito, Keycloak, Supabase, custom).
• Compliance or security requirements (SOC 2, PCI, HIPAA, token revocation needs).

1. Flow Selection (Static)