nandan_prabhu
1128024c02
* feat: Add Auth0 Flutter Windows desktop reference
auth0_flutter reached Windows GA in v2.1.0 with a distinct API
(windowsWebAuthentication(), custom URL scheme + Registry protocol
handler, no CredentialsManager) that neither the existing
flutter-native (iOS/Android) nor flutter-web references cover.
- Add references/framework-flutter-windows/index.md, verified against
auth0/auth0-flutter's raw README/FAQ/EXAMPLES and example runner
source (vcpkg setup, CMakeLists toolchain wiring, Registry scheme
registration, main.cpp mutex/named-pipe integration, manual
credential storage).
- Wire flutter-windows into SKILL.md's Tier 1/2/3 router tables and
cross-link it from framework-flutter-native/-web's "When NOT to Use".
- Add flutter-windows to validate-skill.sh's EXPECTED_FRAMEWORKS and
the root README coverage table.
- Add routing, activation, and behavioral eval coverage for the new
reference.
* fix: trim SKILL.md prose to stay under skillsaw's context-budget warn limit
The flutter-windows router wiring pushed SKILL.md's estimated token count
over skillsaw's 4,300 warn threshold. Drop the added explanatory prose
(a lead-in sentence and a callout note) and keep only the three backticked
table rows needed for routing/reachability, matching the terse,
table-only convention most other framework rows already use.
* fix: trim SKILL.md prose to stay under skillsaw's context-budget warn limit
CI flagged 4,305 tokens against the 4,300 warn limit after the flutter-windows
rebase. Shortened five prose passages without touching rules or tables.
* fix: address CodeRabbit review findings on Flutter Windows reference
- Split the weak appCustomURL grader into separate login()/logout() call-shape
checks and add Info.plist to the forbidden mobile-only list.
- Require an explicit Windows-target signal before routing to flutter-windows,
since flutter create scaffolds windows/ alongside every other platform dir.
- Derive the single-instance mutex and named-pipe names from the app's custom
scheme instead of a fixed string shared by every app using the example runner.
- Implement real credential persistence (save/restore/clear via
shared_preferences) in the AuthService example instead of leaving TODOs.
- Validate the OAuth state parameter server-side in the /callback handler
before forwarding to the custom scheme.
* fix Flutter Windows router and callback follow-ups
Co-authored-by: sanchitmehtagit <246215521+sanchitmehtagit@users.noreply.github.com>
* fix: address remaining CodeRabbit and human-reviewer findings
- Remove duplicate H1 heading in framework-flutter-windows/index.md
- Replace assert() with ArgumentError for the redirectUrl/returnTo
pairing check, since assert() is stripped from production builds
- Widen the login()/logout() implementation-check regexes so they
also match the receiver-variable style (webAuth.login(...)) used
by the reference's own AuthService example, not just direct chaining
- Scope the intermediary eval's appCustomURL/redirectUrl/returnTo
graders to the correct login()/logout() call instead of matching
those tokens anywhere in the output
* fix: address remaining CodeRabbit findings on Flutter Windows reference
- Check credential expiry before restoring a session
- Guarantee local cleanup in logout() via try/finally, and surface
remote logout failures at the call site
- Actually invoke restoreSession() on startup with a loading gate
- URL-encode code/state/error before redirecting in the /callback handler
- Fix MD031 blank lines around two fenced code blocks
- De-conflate the fw-flutter-windows activation case from generic Auth0 intent
* fix: address latest CodeRabbit review round on Flutter Windows reference
- Replace shared_preferences with flutter_secure_storage for Credentials
persistence (CWE-922: refresh token via offline_access must not be
stored in plaintext)
- Handle malformed/outdated persisted credential records in
restoreSession() instead of leaving the app stuck on the loading screen
- Bind login()/logout() eval graders to the windowsWebAuthentication()
receiver so an unrelated .login()/.logout() call can no longer
false-pass the grader
* revert: restore SKILL.md prose trimmed for since-raised context-budget limit
e60b760 shortened five unrelated prose passages (Step 1 intro, "if nothing
clearly matches", Step 2 skip note, Tier 2 intro, "if still ambiguous",
Conflicts section) to stay under skillsaw's context-budget warn limit, which
was 4,300 tokens at the time. #197 later raised that limit to 5,000. With the
flutter-windows content included, the file is ~4,575 estimated tokens — safely
under the current limit — so the trims are no longer necessary and were
unrelated to this branch's actual scope.
* Update SKILL.md
Removes flutter windows framework detection
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: sanchitmehtagit <246215521+sanchitmehtagit@users.noreply.github.com>
10 KiB
Auth0 Agent Skills
AI agent skills that help coding assistants implement Auth0 authentication correctly. Works with Claude Code, Cursor, Codex, GitHub Copilot, and 40+ other agents that support the Agent Skills format.
Documentation · Getting Started · Feedback
Prerequisites
- An Auth0 account (free)
- An AI coding assistant (Claude Code, Cursor, Codex, GitHub Copilot, or any Agent Skills-compatible tool)
Install
Claude Code
Auth0 is on the official Claude Code plugins marketplace:
/plugin install auth0@claude-plugins-official
Or type /plugin in a session, go to Discover, and search "Auth0".
From the terminal (no session needed):
claude plugin install auth0@claude-plugins-official
Cursor
Auth0 is on the Cursor marketplace. Open the listing and click Add to install.
You can also install via Cursor Settings → Rules → Add Rule → Remote Rule (GitHub) and enter this repository URL.
npx skills add auth0/agent-skills --agent github-copilot
Codex / ChatGPT plugins
The repository includes an OpenAI-compatible skills-only plugin. Add this
repository's marketplace from .agents/plugins/marketplace.json, then install
Auth0 from the Plugins UI. It tracks the published main snapshot.
For public availability, Auth0 must submit the plugin through the OpenAI plugin submission portal. Approval is required before it appears in the universal ChatGPT and Codex directory.
Any Agent (Skills CLI)
The Skills CLI works with Claude Code, Cursor, Copilot, Codex, and 40+ other agents:
npx skills add auth0/agent-skills
Target specific agents with --agent:
npx skills add auth0/agent-skills --agent claude-code cursor
ClawHub Marketplace
Install the Auth0 skill from ClawHub.ai:
npx clawhub install auth0
Or browse and install from the ClawHub web UI — search for "auth0".
What happens after install
When you ask your AI assistant something like "add Auth0 login to my app," the assistant:
- Loads the single
auth0skill, whose router reads your project files (package.json,requirements.txt,build.gradle, etc.) - Detects your framework and loads the matching reference files (e.g., the Next.js reference for a Next.js project)
- Follows the step-by-step instructions to install the right SDK, create auth routes, configure environment variables, and wire up login/logout
You don't pick anything manually — framework detection handles it.
Forcing the skill with /auth0
Auto-detection is reliable on capable models. If you're on a smaller/faster model in a session with many other skills installed, the assistant can occasionally miss the trigger — most often on open-ended questions ("how do I…?") rather than direct instructions. When that happens, invoke the skill explicitly:
/auth0 how do I configure brand colors in Auth0?
Naming the skill removes the selection step entirely, so it always activates.
Migrating from the individual skills
Earlier versions shipped one skill per SDK/framework (auth0-react,
auth0-nextjs, express-oauth2-jwt-bearer, …). These are now consolidated
into the single auth0 skill above, which routes to the same guidance by
detecting your framework.
- Plugin / marketplace installs (Claude Code, Cursor): nothing to do — your next update swaps in the consolidated skill automatically.
- ClawHub installs: existing installs keep working;
npx clawhub install auth0gets you the consolidated skill. - If you referenced an old skill by name — in your
CLAUDE.md, another skill'srequires.skills, or any instruction file — those names (auth0-react, etc.) no longer exist and the reference will dangle. Replace them withauth0.
Coverage
A single auth0 skill covers web, mobile, desktop, and API authentication
across all of the frameworks below. You install one skill; its router detects
your framework and loads the matching guidance — you don't choose a
per-framework skill.
| Area | SDK | Frameworks |
|---|---|---|
| Quickstart Router | — | Detects your framework and loads the right reference files |
| Migration | — | Migrate from Firebase, Cognito, Supabase, Clerk, or custom auth |
| MFA | — | TOTP, SMS, email, push, WebAuthn |
| ACUL Screen Generation | @auth0/auth0-acul-react |
Custom Universal Login screens and theming |
| React | @auth0/auth0-react |
React SPAs (Vite, CRA) |
| Vue | @auth0/auth0-vue |
Vue 3 |
| Angular | @auth0/auth0-angular |
Angular 13+ |
| Vanilla JS | @auth0/auth0-spa-js |
Any SPA (also Svelte, SolidJS) |
| Next.js | @auth0/nextjs-auth0 |
Next.js 13+ (App Router & Pages Router) |
| Nuxt | @auth0/auth0-nuxt |
Nuxt 3/4 |
| Express | express-openid-connect |
Express.js |
| Flask | auth0-server-python |
Flask |
| Fastify | @auth0/auth0-fastify |
Fastify |
| Java Servlet | mvc-auth-commons |
Java Servlet |
| Express API | express-oauth2-jwt-bearer |
Node.js/Express APIs |
| Fastify API | @auth0/auth0-fastify |
Fastify APIs |
| FastAPI | auth0-fastapi-api |
Python FastAPI |
| Spring Boot API | auth0-springboot-api |
Spring Boot |
| ASP.NET Core | Auth0.AspNetCore.Authentication |
ASP.NET Core MVC, Razor Pages, Blazor Server |
| ASP.NET Core API | Auth0.AspNetCore.Authentication |
ASP.NET Core |
| Ionic Angular | @auth0/auth0-angular + Capacitor |
Ionic Angular + Capacitor (iOS/Android) |
| Ionic Vue | @auth0/auth0-vue |
Ionic Vue + Capacitor (iOS/Android) |
| Ionic React | @auth0/auth0-react + Capacitor |
Ionic React + Capacitor (iOS/Android) |
| React Native | react-native-auth0 |
React Native CLI (bare workflow) |
| Expo | react-native-auth0 |
Expo (managed workflow) |
| Android | Auth0.Android |
Android (Kotlin/Java) |
| iOS/macOS | Auth0.swift |
Swift (iOS, macOS, tvOS, watchOS, visionOS) |
| Flutter | auth0_flutter |
Flutter mobile (iOS/Android, Dart) |
| Flutter Web | auth0_flutter |
Flutter Web (Dart) |
| Flutter Windows | auth0_flutter |
Flutter Windows desktop (Dart) |
| .NET MAUI | Auth0.OidcClient.MAUI |
.NET MAUI (iOS, Android, macOS, Windows) |
| .NET Android | Auth0.OidcClient.AndroidX |
.NET Android (Xamarin) |
| .NET iOS | Auth0.OidcClient.iOS |
.NET iOS (Xamarin) |
| .NET Winforms | Auth0.OidcClient.WinForms |
.NET WinForms applications |
| WPF | Auth0.OidcClient.WPF |
.NET WPF |
| iOS/macOS Migration | Auth0.swift |
Upgrade to the latest major version of Auth0.swift |
Example prompts
Add Auth0 authentication to my app
Set up Auth0 in my Next.js project with protected routes
Add multi-factor authentication with TOTP
Migrate from Firebase Auth to Auth0
Secure my Express API with Auth0 JWT validation
Feedback
- Open an issue to report bugs or request new skills
- See contribution guidelines and code of conduct
- Security vulnerabilities: Responsible Disclosure Program
Auth0 is an easy to implement, adaptable authentication and authorization platform.
To learn more checkout Why Auth0?
This project is licensed under the Apache 2.0 license. See the LICENSE file for more info.