saas-auth-patterns
SaaS authentication and authorization patterns including JWT vs session strategies, multi-tenant isolation, RBAC, API key management, passwordless flows, MFA, and secure session handling.
npx skills add vibeeval/vibecosystem --skill saas-auth-patterns --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# SaaS Auth Patterns Authentication and authorization patterns for multi-tenant SaaS applications. ## Auth Strategy Decision Matrix | Strategy | Stateless | Scalable | Revocable | Best For | |----------|-----------|----------|-----------|----------| | JWT + Refresh | Yes | High | Hard (needs blocklist) | API-first, mobile clients | | Session (server) | No | Medium (sticky/shared store) | Instant | Traditional web apps | | OAuth 2.0 + PKCE | Yes | High | Via provider | Third-party login, SSO | Pick JWT when you control both client and server and need horizontal scaling. Pick sessions when you need instant revocation and serve server-rendered pages. Pick OAuth when users expect "Sign in with Google/GitHub" or you federate identity. ## Multi-Tenant Auth ### Tenant Isolation Middleware ```typescript interface TenantContext { tenantId: string userId: string role: string } // Extract tenant from JWT claims or subdomain function resolveTenant(req: Request): TenantContext { const token = req.headers.get('authorization')?.replace('Bearer ', '') if (!token) throw new AuthError('Missing token') const payload = verifyJwt(token) return { tenantId: payload.tenantId, userId: payload.sub, role: pa
- Auth Strategy Decision Matrix
- Multi-Tenant Auth
- Tenant Isolation Middleware
- Shared DB vs Isolated DB
- Account Linking (Email + Social Merge)
- Role-Based Access Control (RBAC)
- API Key Management
- Magic Link / Passwordless Flow
- MFA Integration
- Session Management
- Token Storage: GOOD vs BAD
What does the saas-auth-patterns skill do?
SaaS authentication and authorization patterns including JWT vs session strategies, multi-tenant isolation, RBAC, API key management, passwordless flows, MFA, and secure session handling.
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill saas-auth-patterns --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 521 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.