Creative Design & Branding
OAuth2 Provider Design
Design the OAuth2 authorization-server surface a B2B SaaS offers third-party apps - the OAuth 2.1 protocol baseline (PKCE for every client, no implicit or password grants, exact redirect matching), token TTL and refresh-rotation policy, scope taxonomy and granularity, consent-screen design with partial and incremental grants, client registration posture, and the tiered app-verification program. Use whenever the user mentions OAuth, "Sign in with X", access and refresh tokens, scopes, consent screens, PKCE, or third-party apps acting on a customer's behalf - even if they never say "OAuth provider". Issuer side only, not integrating against someone else's OAuth. Do NOT use for API-key design - use samber/developer-platform-skills@api-auth-key-management instead.
- Publisher / source
- samber/developer-platform-skills (found on skills.sh)
- Upstream record
- samber/developer-platform-skills
- Version
- Version 3
- Published
- Publication review
- Approved for publication
- Content fingerprint
2aefead40f01fda3612c80c99fb81f6e80620e71cd3f10e06744b1e726c38eec