skills.rest
FarooqProProgrammer
FarooqProProgrammerCOMMUNITY
Explore all skills by this author →
GitHub

backend-standards

Enforces backend standards for auth flows, OTP, sessions, APIs, and Stripe payments.

Updated Sep 8, 2026
Search Tags:#authentication#backend#stripe#express#otp#2fa#api security
One-click install
npx skills add https://github.com/FarooqProProgrammer/the-magician --skill backend-standards-farooqproprogrammer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: backend-standards
Source: https://github.com/FarooqProProgrammer/the-magician/tree/main/claude-plugin/skills/backend-standards
Command: npx skills add https://github.com/FarooqProProgrammer/the-magician --skill backend-standards-farooqproprogrammer

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Building secure authentication and backend APIs involves many subtle failure modes—account enumeration, OTP replay, session fixation, SQL injection, and webhook forgery. This Skill provides a complete, opinionated rulebook so every backend module follows the same secure patterns instead of reinventing them inconsistently. ## Core Features & Use Cases - Mandatory auth flows: Specifies the exact signup/OTP/profile, forgot-password/OTP/reset, and login/2FA sequences, including transaction boundaries and anti-enumeration behavior. - Security rules: Covers OTP generation and storage, refresh token rotation with reuse detection, Argon2id/bcrypt password hashing, rate limiting, and Redis key conventions with TTLs. - Architecture and conventions: Defines the Express + TypeScript + PostgreSQL + Redis stack, the route/controller/service/repository layering, unified response envelopes, and API conventions. - Payments and testing: Guides Stripe integration via the Stripe MCP server with webhook signature verification and idempotency, plus failure-mode end-to-end testing requirements. - Use Case: When scaffolding a new auth module, apply this Skill to generate the signup, verify-OTP, and login endpoints with correct OTP hashing, attempt caps, and session issuance order. ## Quick Start Use the backend-standards skill to review my Express auth module and verify the signup, OTP verification, and login flows follow the mandated security rules.

Frequently Asked Questions about backend-standards

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement a secure signup flow with OTP verification?▼

Create the user with status unverified, issue a six-digit OTP hashed in Redis with a 10-minute TTL, and return 202 without a session. On verify-otp, check hash, expiry, attempts, and purpose, then mark verified and create the profile in one transaction before issuing the session.

How should a forgot-password reset flow be structured?▼

Keep three separate endpoints: forgot-password issues an OTP only for real verified accounts with identical 202 responses, verify-otp returns a single-use 10-minute reset token, and reset-password consumes that token, enforces password policy, and revokes all sessions.

What is the correct way to handle refresh tokens and sessions?▼

Use a 15-minute access token with a long-lived rotating refresh token. Detect reuse so a replayed refresh token revokes the whole family, keep a server-side revocation list, and store refresh tokens in httpOnly, secure, sameSite cookies for browsers.

Does this standard support two-factor authentication with TOTP?▼

Yes. Login with 2FA enabled issues only a 5-minute single-use challenge token, and 2fa/verify accepts an RFC 6238 TOTP code or a hashed single-use recovery code. Five failed attempts invalidate the challenge and force a fresh login.

How should Stripe webhooks be handled in the backend?▼

Verify every webhook signature before acting and make handlers idempotent since Stripe retries. Treat the webhook, not the client redirect, as the source of truth, use integer minor units for amounts, and never trust client-supplied prices.

Why must OTPs never be stored or returned in plain text?▼

Plain OTPs in storage, logs, or responses become bearer credentials anyone can replay. The standard requires storing only a hash, using constant-time comparison, capping attempts at five, and scoping each OTP by purpose so a signup code cannot satisfy a password reset.

Related Skills

Explore More Software Engineering Skills→
wpankwpank
11

nodejs-patterns

Generate Express API structures with layered architecture and error handling.

Community
Advanced
Cap-goCap-go
58

capacitor-ci-cd

Automates CI/CD for Capacitor apps across GitHub Actions, GitLab CI, and Fastlane workflows.

Official
Advanced
OntoLedgyOntoLedgy

javascript-data-engineer

Enforce TypeScript type safety and JS/TS best practices in data pipelines.

Official
Intermediate
GELLIFYGELLIFY
6

two-factor-authentication-best-practices

Implement TOTP, OTP, and backup codes with Better Auth.

Official
Advanced