shoo-auth

Shoo Auth

Deterministic workflow for deciding when Shoo fits and for applying it safely. This draft is not enabled automatically.

Primary reference snapshot: references/shoo-docs-summary.md. Refresh the live Shoo docs before high-stakes or production decisions.

When to Use

Use this skill when the task mentions any of:

• Shoo, shoo.dev, @shoojs/auth, @shoojs/react, window.Shoo, shoo.js, or pairwise_sub.
• Adding minimal Google sign-in to a browser app without Google client registration.
• Choosing between Shoo React, vanilla JS, framework-agnostic, hosted-script, or Convex integration.
• Implementing or reviewing Shoo callback handling, PKCE flow, session/revocation checks, or server-side id_token verification.
• Debugging Shoo audience, callback, storage, Convex JWT, or missing-PII issues.

Do not use this skill as the primary workflow for unrelated auth providers or generic OAuth/OIDC work, except to explicitly decide that Shoo is not a fit.

Do Not Use / Escalate

Do not recommend Shoo as the sole answer when requirements include:

• Non-Google identity providers, passwords, enterprise SSO/SAML/SCIM, or rich hosted user management.
• Server-only auth without a browser redirect flow.
• Production authorization based only on browser-local identity, localStorage, or decoded-but-unverified JWT claims.
• Security/compliance-critical auth where maturity, SLAs, audit evidence, or operational ownership must be established first.

When any of these apply, state the mismatch and either ask whether Shoo is still mandatory or recommend comparing established auth providers.

Inputs and Assumptions

Before changing code, determine these from the user or the project:

• Frontend shape: React, Next.js, vanilla/static, Convex, or another browser client.
• App origin for each environment, e.g. http://localhost:3000 and https://app.example.com.
• Callback path and whether that path is served by the app/router.
• Server/runtime that will verify Shoo id_tokens.
• Whether PII (email, name, picture) is actually needed.
• Package manager and existing auth/session conventions.