ClaudeSuperPower
SubmitLog in

catalyst-authentication

Skill

Catalyst Authentication — user login/signup, ZAID, Web SDK auth flows, and OAuth token management via Connections. Trigger on 'authentication', 'login', 'signup', 'getCurrentUser', 'ZAID', 'isUserAuthenticated', 'signOut', 'Connections', or 'getAccessToken'. You MUST load this skill whenever impleme

0Security

Install

git clone https://github.com/catalystbyzoho/claude-plugin.git ~/.claude/skills/catalyst-authentication

What is catalyst-authentication?

Catalyst Authentication — user login/signup, ZAID, Web SDK auth flows, and OAuth token management via Connections. Trigger on 'authentication', 'login', 'signup', 'getCurrentUser', 'ZAID', 'isUserAuthenticated', 'signOut', 'Connections', or 'getAccessToken'. You MUST load this skill whenever implementing user login or protecting data — ZAID differs between Development and Production and is the #1 cause of auth failures after environment promotion. For Security Rules (function invocation control), route to catalyst-functions.

What this can do

Capabilities declared in this component's own frontmatter — not inferred.

Inherit all session tools

Declares no tool restrictions — inherits every session tool

~133 tokens of context used while enabled, before you invoke anything

Documentation

README · ~2 min read

🚦 Local auth requires plain catalyst serve

Auth works locally only when the frontend is served through catalyst serve; prefer plain catalyst serve so Functions/AppSail run alongside Slate. NEVER use the native dev server (npm run dev, vite, next dev, ng serve, …) — it lacks the /__catalyst/sdk/init.js endpoint, session cookie, ZAID, and managed-service proxy, so login/signup, getCurrentUser, and isUserAuthenticated fail (401) though the page renders. If auth "doesn't work locally," check this first. See ../catalyst-slate/.

How It Works

  1. Identify flow type — Hosted login (redirect to Catalyst login page), embedded login (custom UI), or backend getCurrentUser check.
  2. Load references/auth-basics.md — for signup/login flows, ZAID gotcha, hosted vs embedded login, and common auth errors.
  3. ZAID warning — ZAID differs between Development and Production. This is the #1 auth issue in production. Always verify the environment.
  4. Security Rules — If the query involves controlling who can invoke a function, route to catalyst-functions skill and its ../catalyst-functions/references/functions-basics.md Security Rules section. Security Rules has two parameters: (a) methods — which HTTP methods (GET/POST/PUT/DELETE/PATCH) are enabled for the function (removing a method blocks that verb entirely), and (b) authentication — a single binary flag (optional = public, required = authenticated users only) applied function-wide, not per-method. For role-based data access control, route to DataStore Scopes and Permissions (Console → Table → Scopes and Permissions).
  5. OAuth / Connections — Load references/connections.md for external API OAuth token management (Zoho or third-party).

Security Checklist

Reviews

Log in to leave a review.

No reviews yet — be the first.

Explore related

Other things in this space — across every part of the ecosystem, not just skills.