jwt-auth
Implement FastAPI JWT Authentication
JWT authentication requires careful token creation, validation, and claim handling. This skill guides FastAPI implementations for access tokens, dependencies, RBAC, and safe configuration.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "jwt-auth" from https://skillstore.io/skills/awais68-jwt-auth.md and its manifest at https://skillstore.io/api/skills/awais68-jwt-auth/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "jwt-auth". Build JWT authentication for a FastAPI router with current user extraction.
Expected outcome:
- A token creation plan with subject, expiry, and optional roles.
- A dependency plan for validating bearer tokens before protected routes run.
- A configuration checklist for secret key, algorithm, and expiration values.
Using "jwt-auth". Add admin only access to a delete endpoint.
Expected outcome:
- A role check approach that reads roles from verified token claims.
- A protected endpoint behavior description for allowed and rejected users.
- A test checklist for admin, non-admin, expired token, and missing token cases.
Using "jwt-auth". Review whether token claims are safe for production.
Expected outcome:
- A claim review that separates required identifiers from sensitive data.
- A recommendation to keep passwords, secrets, and private profile data out of tokens.
- A short list of expiry, blacklist, and refresh flow follow-up tasks.
Security Audit
SafeI found no executable command usage, system reconnaissance, or secret exfiltration in the reviewed files. Static detections in SKILL.md are Markdown code spans, fenced Python examples, and environment variable documentation; scripts/verify.py only validates local skill metadata.
Risk Factors
⚙️ External commands (31)
🔑 Env variables (1)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/awais68-jwt-auth/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/awais68-jwt-auth?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/awais68-jwt-auth?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/awais68-jwt-auth/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/awais68-jwt-auth.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
Awais68. (2026). jwt-auth security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/awais68-jwt-auth/audits/8BibTeX citation
@techreport{awais68-awais68-jwt-auth-2026,
author = {Awais68},
title = {jwt-auth security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/awais68-jwt-auth/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "jwt-auth security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "Awais68"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/awais68-jwt-auth/audits/8"
identifiers:
- type: other
value: "skillstore:awais68-jwt-auth:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Add API Authentication
Create token generation and verification patterns for protected FastAPI endpoints.
Review JWT Security
Check token expiry, secret handling, claim contents, and invalidation requirements before release.
Connect Frontend Login
Align bearer token storage and request headers with backend validation behavior.
Try These Prompts
Use the jwt-auth skill to outline a basic FastAPI JWT flow with token creation, token expiry, and current user extraction.
Use the jwt-auth skill to protect these FastAPI routes with a current user dependency and clear unauthorized response behavior.
Use the jwt-auth skill to design role based access checks for admin and editor endpoints using claims from the JWT payload.
Use the jwt-auth skill to audit a FastAPI JWT implementation for expiry, claim safety, logout invalidation, secret configuration, and frontend bearer token flow.
Best Practices
- Use short lived access tokens and plan a refresh or reauthentication flow.
- Store only minimal identifiers and authorization claims inside JWT payloads.
- Keep signing secrets in environment configuration with strong random values.
Avoid
- Do not place passwords, API keys, or sensitive profile data in token claims.
- Do not disable algorithm validation or accept unsigned tokens.
- Do not rely on long lived access tokens without logout invalidation planning.
Frequently Asked Questions
What framework does this skill target?
Does it implement OAuth2 or OpenID Connect?
Can it help with role based authorization?
Does it require environment variables?
Can it review existing JWT code?
Is this suitable for non-Python backends?
Developer Details
Author
Awais68License
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/Awais68/hackathon-2-phase-ii-full-stack-web-app/tree/main/.claude/skills/jwt-authRef
5ab1d37e83436c6eef84de88573e142b94f2a4ad
Maintenance freshness
7/20/2026
Usage
5 downloads · 189 views