Agent-Skills.md

Agent Skills: Clous OAuth Integration

Use when implementing Clous OAuth 2.1 or OIDC clients, including PKCE, discovery, protected-resource metadata, token exchange, refresh, and userinfo.

UncategorizedID: clous-ai/agents/oauth-integration

Repository

clous-ai/agents
clous-aiLicense: NOASSERTION

Install this agent skill to your local

pnpm dlx add-skill https://github.com/clous-ai/plugins/tree/HEAD/clous-development/skills/oauth-integration

Skill Files

Browse the full folder contents for oauth-integration.

Download Skill

Loading file tree…

clous-development/skills/oauth-integration/SKILL.md

Skill Metadata

Name
oauth-integration
Description
Use when implementing Clous OAuth 2.1 or OIDC clients, including PKCE, discovery, protected-resource metadata, token exchange, refresh, and userinfo.

Clous OAuth Integration

Clous OAuth endpoints live on the API origin, normally https://api.clous.app.

Discovery

  • GET /.well-known/openid-configuration
  • GET /.well-known/oauth-protected-resource
  • GET /oauth/.well-known/openid-configuration

Flow

  1. Generate a PKCE verifier/challenge pair.
  2. Build /oauth/authorize/ URL with response_type=code, client_id, redirect_uri, scope, state, code_challenge, and code_challenge_method=S256.
  3. Exchange the code at /oauth/token/.
  4. Store access and refresh tokens in the host secret store.
  5. Call /oauth/userinfo/ only when identity display or tenant routing requires it.

Guardrails

  • Reject redirect URIs not registered for the client.
  • Never write OAuth tokens into repo files, logs, prompts, or examples.
  • Keep user-delegated OAuth distinct from server API keys.