saas-cli-auth-flow
Made by JeffSaaS CLI-to-web auth: PKCE OAuth, RFC 8628 device code, token lifecycle, secure storage. Use when building CLI login, device-code verify, token refresh, or headless SSH auth.
Works With
Quality and Utility come from canonical skill metadata. Community ratings appear separately as stars when subscriber reviews exist.
Subscribe to download
Public previews are available, but downloads, CLI sync, and premium content require an active subscription.
Sign In to Subscribe- Full skill content with deterministic versioning
- CLI sync + local search index
- Access to Jeffrey’s premium library
Save to your account
Saved skills live in your cloud list. Run jsm sync on each machine to pull them locally.
What's New with this Skill
1Updates, enhancements, and release notes for this skill.
New: SaaS CLI Auth Flow, production OAuth for CLI tools that works over SSH
A blueprint for connecting a CLI tool to a web subscription service. Three-tier auth architecture (Browser PKCE, Device Code, Manual Paste), RFC 8628 device code flow, token lifecycle management, and secure credential storage, with patterns extracted from production code.
- Three-tier auth: Browser PKCE → Device Code → Manual Paste with automatic environment detection
- RFC 8628 device code flow with ambiguity-safe user codes (ABCD-1234) and polling with backoff
- Complete token lifecycle: mint, refresh, revoke with advisory locks preventing race conditions
- Secure credential storage: OS keyring → AES-256-GCM encrypted file fallback chain
- Production server implementation: 8 API routes with PKCE verification and one-time code enforcement
- CLI-side Rust patterns: async environment detection, stdin paste fallback, retry clients
- Database schema with migration templates for cli_tokens and device_codes tables
- Security hardening checklist: timing-safe comparisons, CSRF state, suspension enforcement, SSO policy gating
- 16 documented anti-patterns with real incident context explaining why each fails
- Protocol design template you can adapt for any SaaS CLI authentication system
This skill turns the lessons from building the jsm CLI authentication system into a framework-agnostic guide.
The core insight: your CLI users are SSH'd into remote servers, running in containers, or working in CI; they can't just "open a browser." You need three authentication tiers that degrade based on environment detection.