popup-studio-ai/bkend-auth
skills/bkend-auth/SKILL.md
bkend.ai authentication — email/social login, JWT tokens, RBAC, session management. Triggers: bkend auth, login, signup, JWT, RBAC, 인증, 로그인, 회원가입.
$ install --global
skillsauthnpx skillsauth add popup-studio-ai/bkit-claude-code bkend-authInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 5:19 AM8.8s1 file scanned
SKILL.md
- name:
- bkend-auth
- classification:
- capability
- classification-reason:
- Pattern guidance may overlap with model's built-in knowledge as it improves
- deprecation-risk:
- medium
- effort:
- medium
- description:
- |
- Triggers:
- bkend auth, login, signup, JWT, RBAC, 인증, 로그인, 회원가입.
- user-invocable:
- false
- agent:
- bkit:bkend-expert
bkend.ai Authentication & Security Guide
Auth Methods
| Method | Description | |--------|-------------| | Email + Password | Email/password signup and login | | Social (Google) | OAuth 2.0 social login | | Social (GitHub) | OAuth 2.0 social login | | Magic Link | Email link login (no password) |
JWT Token Structure
- Access Token: 1 hour validity
- Refresh Token: 7 days validity
- Auto-refresh:
POST /v1/auth/refresh
Password Policy
8+ characters, uppercase + lowercase + numbers + special characters
MCP Auth Workflow
bkend MCP does NOT have dedicated auth tools. Use this workflow:
- Search docs:
search_docswith query "email signup" or "social login" - Get examples:
search_docswith query "auth code examples" - Generate code: AI generates REST API code based on search results
Searchable Auth Docs
| Doc ID | Content |
|--------|---------|
| 3_howto_implement_auth | Signup, login, token management guide |
| 6_code_examples_auth | Email, social, magic link code examples |
Key Pattern
User: "Add social login"
→ search_docs(query: "social login implementation")
→ Returns auth guide with REST API patterns
→ AI generates social login code
REST Auth API (Core Endpoints)
For the complete endpoint list, use search_docs or check Live Reference.
| Method | Endpoint | Description | |--------|----------|-------------| | POST | /v1/auth/email/signup | Sign up | | POST | /v1/auth/email/signin | Sign in | | GET | /v1/auth/me | Current user | | POST | /v1/auth/refresh | Refresh token | | POST | /v1/auth/signout | Sign out | | GET/POST | /v1/auth/:provider/callback | Social login callback | | POST | /v1/auth/password/reset/request | Password reset | | POST | /v1/auth/password/reset/confirm | Confirm reset | | POST | /v1/auth/password/change | Change password | | GET | /v1/auth/sessions | List sessions | | DELETE | /v1/auth/sessions/:sessionId | Remove session | | DELETE | /v1/auth/withdraw | Delete account |
Additional endpoints (MFA, invitations, user management): use search_docs or Live Reference.
RBAC (Role-Based Access Control)
| Group | Description | Scope | |-------|-------------|-------| | admin | Full CRUD | All data | | user | Authenticated user | Full read, own write | | self | Owner only | createdBy-based | | guest | Unauthenticated | Read only (usually) |
RLS (Row Level Security)
- Per-table row-level access control
- 4-level policies: admin/user/self/guest
- Auto-filtering based on createdBy field
Session Management
- Per-device session tracking
GET /v1/auth/sessions- List sessionsDELETE /v1/auth/sessions/:sessionId- Remove session
Official Documentation (Live Reference)
For the latest authentication documentation, use WebFetch:
- Auth Overview: https://raw.githubusercontent.com/popup-studio-ai/bkend-docs/main/en/authentication/01-overview.md
- MCP Auth Guide: https://raw.githubusercontent.com/popup-studio-ai/bkend-docs/main/en/mcp/06-auth-tools.md
- Security: https://raw.githubusercontent.com/popup-studio-ai/bkend-docs/main/en/security/01-overview.md
- Full TOC: https://raw.githubusercontent.com/popup-studio-ai/bkend-docs/main/SUMMARY.md
Related Skills
popup-studio-ai/sprint
testing
VerifiedTrustedCommunity
Sprint Management — generic sprint capability for ANY bkit user. 16 sub-actions: init, start, status, watch, phase, iterate, qa, report, archive, list, feature, pause, resume, fork, help, master-plan. Triggers: sprint, sprint start, sprint init, sprint status, sprint list, 스프린트, 스프린트 시작, 스프린트 상태, スプリント, スプリント開始, スプリント状態, 冲刺, 冲刺开始, 冲刺状态, sprint, iniciar sprint, estado sprint, sprint, demarrer sprint, statut sprint, Sprint, Sprint starten, Sprint Status, sprint, avviare sprint, stato sprint, master plan, multi-sprint plan, sprint master plan, 마스터 플랜, 멀티 스프린트 계획, 스프린트 마스터 플랜, マスタープラン, マルチスプリント計画, スプリントマスタープラン, 主计划, 多冲刺计划, 冲刺主计划, plan maestro, plan multi-sprint, plan maestro sprint, plan maître, plan multi-sprint, plan maître sprint, Masterplan, Multi-Sprint-Plan, Sprint-Masterplan, piano principale, piano multi-sprint, piano principale sprint.
548SKILL.mdUpdated May 13, 2026
popup-studio-ai/cc-version-analysis
tools
VerifiedTrustedCommunity
CC CLI version upgrade impact analysis — research changes, analyze bkit impact, generate report. Triggers: cc-version-analysis, CC upgrade, version analysis, CC 버전 분석, 버전 영향.
545SKILL.mdUpdated Apr 18, 2026
popup-studio-ai/rollback
testing
VerifiedTrustedCommunity
Manage PDCA checkpoints and rollback — create, list, restore for safe recovery. Rollback events are recorded via lib/audit/audit-logger ACTION_TYPES.rollback_executed. For sprint-level recovery, individual feature rollbacks may be triggered from within sprint phases (sprint itself is forward-only — terminal state is `archived`, not rolled back; v2.1.13). Triggers: rollback, checkpoint, restore, undo, 롤백, 체크포인트, 복원.
539SKILL.mdUpdated Apr 18, 2026
popup-studio-ai/qa-phase
testing
VerifiedTrustedCommunity
QA Phase execution — L1-L5 test planning, generation, execution, and reporting for a single feature. For sprint-level QA (7-Layer dataFlowIntegrity / S1 gate across multiple features) use /sprint qa <sprintId> which delegates to sprint-qa-flow agent (v2.1.13). Triggers: qa phase, QA test, qa run, QA 실행, QAフェーズ, QA阶段, fase QA, phase QA, QA-Phase, fase QA.
539SKILL.mdUpdated Apr 18, 2026