ClaudeSuperPower

identityserver-token-lifecycle

Skill

Guide for implementing token types, refresh token management, token exchange (RFC 8693), extension grants, IProfileService claims customization, and token lifetime best practices in Duende IdentityServer.

Install

git clone https://github.com/DuendeSoftware/duende-skills.git ~/.claude/skills/identityserver-token-lifecycle

What is identityserver-token-lifecycle?

Guide for implementing token types, refresh token management, token exchange (RFC 8693), extension grants, IProfileService claims customization, and token lifetime best practices in Duende IdentityServer.

What this can do

Capabilities declared in this component's own frontmatter — not inferred.

Inherit all session tools

Declares no tool restrictions — inherits every session tool

~51 tokens of context used while enabled, before you invoke anything

Documentation

README · ~10 min read

IdentityServer Token Types, Refresh Tokens, and Token Exchange

When to Use This Skill

  • Choosing between JWT and reference access tokens for a client
  • Configuring refresh token rotation, sliding expiration, or replay detection
  • Implementing token exchange (RFC 8693) for impersonation or delegation
  • Building an extension grant validator (IExtensionGrantValidator)
  • Customizing which claims appear in identity tokens, access tokens, or userinfo responses via IProfileService
  • Setting token lifetime policies for access tokens and refresh tokens
  • Issuing internal tokens from extensibility code via IIdentityServerTools
  • Understanding identity tokens vs access tokens and their intended audiences

Reviews

Log in to leave a review.

No reviews yet — be the first.

Explore related

Other things in this space — across every part of the ecosystem, not just skills.

Skillssimilar to this one

All skills