An installable agent skill for wiring up Start.gg OAuth 2.0 with PKCE without turning every app into a one-off auth experiment.
It is built around startgg-oauth2-full and stays focused on the part that usually gets messy in real projects: where the flow should live, how to keep PKCE and state handling sane, and how to debug the failures that show up once the happy path is over.
This repo contains one standalone skill:
The skill is meant for agent workflows in app repos that need Start.gg sign-in, PKCE URL generation, authorization code exchange, bearer token handling, or refresh/debugging guidance.
It is not a generic OAuth reference dump. It is opinionated in the useful places and quiet everywhere else.
| Area | What it helps with |
|---|---|
| Flow design | Decide what belongs in browser code, callback handlers, and server routes |
| PKCE | Generate and persist verifier/state correctly |
| Code exchange | Use the package helpers instead of bespoke request glue |
| Bearer tokens | Normalize token handling and expiry checks |
| Framework placement | Fit the flow into Next.js, Vite, browser-only apps, or Node backends |
| Debugging | Trace state mismatch, redirect URI problems, verifier issues, scope drift, and token request shape |
startgg-oauth2/
├── SKILL.md
├── agents/
│ └── openai.yaml
└── references/
├── startgg-flow.md
├── framework-recipes.md
└── troubleshooting.md
The actual skill lives at:
The references are split on purpose:
That keeps the main skill readable while still giving it enough depth when something goes sideways.
Use this skill when a project needs to:
- add Start.gg login to a web app
- implement Authorization Code with PKCE cleanly
- exchange codes for tokens using
startgg-oauth2-full - validate scopes and state handling
- debug token, verifier, redirect URI, or refresh issues
Skip it when the task is just generic OAuth theory or when the app is not using Start.gg at all.
This repo is intentionally small. If it grows, it should grow by becoming sharper, not louder.
The package work this skill is built around came out of a Start.gg OAuth2 + PKCE implementation that scored 94.4 in benchmark review, with a 7.5/10 trust rating. That is not meant as a badge. It is just a fair signal that the guidance here comes from work that was already judged on correctness and reliability, not improvised from generic OAuth notes.