An approach for adding authentication and authorization to an app: authentication checks who a user is, while authorization controls what that user may do. It covers choices such as login, sessions, tokens, roles, permissions, team access, SSO, and social login.

Use it when adding sign-up and sign-in, protecting pages or API routes, or supporting admins, organizations, teams, or enterprise single sign-on. It helps decide how users and their access should be modeled.

It avoids the security risks of building password handling, login sessions, and account recovery from scratch. It helps choose an established provider and a permission model suited to the product.

auth — Skill for Claude Code by MartinOlivero/saas-builder

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add MartinOlivero/saas-builder --skill auth

Clone the repo

git clone --depth 1 https://github.com/MartinOlivero/saas-builder

Made for: Claude Code.

Or install saas-builder, the plugin that ships this one along with the rest of its 22 skills, 1 hook.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/martinolivero/saas-builder/auth/github.svg)](https://agentmods.dev/skills/martinolivero/saas-builder/auth)

Your own site

<a href="https://agentmods.dev/skills/martinolivero/saas-builder/auth"><img src="https://agentmods.dev/badge/skills/martinolivero/saas-builder/auth/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/martinolivero/saas-builder/auth"><img src="https://agentmods.dev/badge/skills/martinolivero/saas-builder/auth.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 121 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,504 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00121	$0.01504
Opus 5.5	$0.00048	$0.00602
Sonnet 5.5	$0.00024	$0.00301
Haiku 4.5	$0.00012	$0.00150

Measured 29d ago against content hash 10acc0e4f4d2, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

auth scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 29d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

Auth that has not been attacked with `curl` is assumed, not known. Before calling it done:

skills/auth/SKILL.md · 84 lines

How it starts

The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Auth

This skill makes the two decisions every SaaS gets wrong: which auth provider and how to model permissions. It picks a vetted provider over hand-rolled auth, and a permission model that fits the product.

Analogy: auth is the lock and the guest list for your building. You don't forge your own lock (you'd leave it pickable) — you buy a good one and decide who gets which key.

The one rule

Don't roll your own auth. Password hashing, session rotation, OAuth flows, and reset tokens are where subtle, catastrophic bugs live. Use a provider or a battle-tested library. (Pairs with the secure-coding skill, which covers the OWASP auth-failure defenses.)

Discovery (max 3 questions, only if unknown)

Is this B2C (individual users) or B2B (organizations/teams with members)?
Do you need enterprise SSO (SAML/OIDC) for buyers — now or soon?
What's the stack/backend — Supabase, plain Vercel + Postgres, or full-stack TypeScript?

Step 1 — Pick the provider (decision tree)

Situation	Use	Why
Building with an agent / on InsForge	InsForge Auth	Agentic-native — the agent wires auth + RLS through its own skills/MCP; every query scopes to the user in SQL.
Already on Supabase	Supabase Auth	Free, RLS-native — every query scopes to the user in SQL. Most-proven ecosystem.
Want the best React DX / drop-in components, not tied to a backend	Clerk	Best components, orgs/teams built in. ~$0.02/MAU after a free tier.
Full-stack TypeScript, want self-hosted control	Better Auth (~28k⭐)	TS-native, framework-agnostic, orgs/RBAC/passkeys/SSO.
Enterprise SSO is a buyer requirement	Auth0 / WorkOS	SAML/OIDC, directory sync, the enterprise checkboxes.

Default for a fresh React + Vite + Postgres SaaS with no SSO need: InsForge Auth if you're building agent-first, Supabase Auth if on Supabase, or Clerk otherwise. All three scope to the user via RLS — match the auth host to the DB host from the data-modeling skill.

Read the full file on GitHub · 84 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

references/field-notes.md 4.6 KB

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

29d ago Changed · +19 lines 10acc0e4f4d2
2mo ago First seen · 65 lines · 121 tokens per session scan A 750e2d499bcb

Subscribe to this mod's changes

auth is a skill published in the GitHub repository MartinOlivero/saas-builder (5 stars, last pushed 26d ago), licensed MIT. It adds 121 tokens to every session and 1,504 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Backend and APIs Claude Code Security architecture landing page plugin saas vibe-coding

auth next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
authMartinOlivero/saas-builder	Skill	5	26d ago	MIT	A	121	Claude Code
architecture-paradigm-microkernelathola/claude-night-market	Skill	348	yesterday	MIT	A	32	Claude Code
plugin-systemellmos-ai/skills	Skill	9	4d ago	MIT	A	27	Claude Code, Codex
saas-migration-auditparisgroup-ai/imersao-ia-setup	Skill	1	1mo ago	MIT	A	90	Claude Code
multi-tenancycamilooscargbaptista/cto-toolkit	Skill	8	7mo ago	MIT	A	22	Claude Code
moai-ref-api-patternsmodu-ai/moai-adk	Skill	1.3k	4d ago	Apache-2.0	A	85	Claude Code
flow-next-impl-reviewgmickel/flow-next	Skill	717	yesterday	MIT	A	34	Claude Code, Codex

auth