Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Covers JWT with refresh tokens, session-based auth, OAuth2/social login, and role-based access control for TypeScript/Node.js backends. Includes working middleware for authentication, RBAC enforcement, resource ownership checks, and password hashing. Targets REST and GraphQL API implementations.
Combines JWT, OAuth2, session management, and RBAC into one reference with production-ready TypeScript code, so you don't have to cross-reference multiple separate guides.
When to use it
- Adding JWT auth to a new Express API
- Integrating Google login into an existing app
- Restricting admin-only routes with role checks
- Replacing stateful sessions with token-based auth
- Debugging 401 and 403 errors in an API
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Add JWT authentication with role-based access control to my Express API
- 1Generates token creation logic with short-lived access tokens and database-backed refresh tokens using jsonwebtoken
- 2Implements authenticate middleware to verify Bearer tokens on protected routes
- 3Defines Role enum and roleHierarchy, then creates requireRole middleware
- 4Applies requireRole to sensitive endpoints like DELETE /api/users/:id
- 5Adds bcrypt password hashing and zod-based password validation
Express routes with JWT issuance, a /api/auth/refresh endpoint, role-gated admin routes, and secure password handling
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.