Skip to content
Scalekit Docs
Talk to an Engineer Dashboard

Coding agents: Add full-stack auth to your app

Let your coding agents guide you into implementing Scalekit full-stack authentication in minutes

Use AI coding agents like Claude Code, GitHub Copilot CLI, Cursor, and OpenCode to implement Scalekit’s full-stack authentication end-to-end in your web applications. This guide shows you how to configure these agents so they analyze your codebase, apply consistent authentication patterns, and generate production-ready code for login, session management, and logout that follows security best practices while reducing implementation time from hours to minutes.

  1. Add the Scalekit Auth Stack marketplace

    Not yet on Claude Code? Follow the official quickstart guide to install it.

    Register Scalekit’s plugin marketplace to access pre-configured authentication skills. This marketplace provides context-aware prompts and implementation guides that help coding agents generate correct Full Stack Auth code.

    Start the Claude Code REPL:

    Terminal
    claude

    Then add the marketplace:

    Claude REPL
    /plugin marketplace add scalekit-inc/claude-code-authstack

    When the marketplace registers successfully, you’ll see confirmation output:

    Terminal
    ❯ /plugin marketplace add scalekit-inc/claude-code-authstack
       ⎿  Successfully added marketplace: scalekit-auth-stack

    The marketplace provides specialized authentication plugins that understand full-stack auth patterns and OAuth 2.0 security requirements. These plugins guide the coding agent to generate implementation code that matches your project structure.

    To remove the Scalekit Auth Stack marketplace, use the uninstall command:

    Claude REPL
    /plugin marketplace remove scalekit-auth-stack

  2. Enable authentication plugins

    Select which authentication capabilities to activate in your development environment. Each plugin provides specific skills that the coding agent uses to generate authentication code.

    Directly install the specific plugin:

    Claude REPL
    /plugin install full-stack-auth@scalekit-auth-stack
    Alternative: Enable authentication plugins via plugin wizard

    Run the plugin wizard to browse and enable available plugins:

    Claude REPL
    /plugins

    Navigate through the visual interface to enable the Full Stack Auth plugin.

  3. Generate authentication implementation

    Use a structured prompt to direct the coding agent. A well-formed prompt ensures the agent generates complete, production-ready Full Stack Auth code that includes all required security components.

    Copy the following prompt into your coding agent:

    Authentication implementation prompt
    Guide the coding agent to implement Scalekit full-stack auth — initialize ScalekitClient with environment credentials, implement the login redirect, handle the OAuth callback to exchange the code for tokens, store the session securely, and add a logout endpoint that clears the session. Code only.

    When you submit this prompt, Claude Code loads the Full Stack Auth skill from the marketplace -> analyzes your existing application structure -> generates Scalekit client initialization with environment credentials -> creates the login redirect handler -> implements the OAuth callback to exchange the authorization code for tokens -> adds secure session storage and a logout endpoint.

  4. Verify the implementation

    After the coding agent completes, verify that all authentication components are properly configured:

    Check generated files:

    • Scalekit client initialization with environment credentials (you may need to set up a .env file with your Scalekit API credentials)
    • Login route that redirects to Scalekit’s authorization endpoint
    • OAuth callback route that exchanges the code for tokens
    • Secure session storage with proper cookie attributes
    • Logout endpoint that clears the session

    The login flow should redirect users to Scalekit’s authorization page, where they authenticate. Your application should then exchange the returned authorization code for tokens, store the session, and redirect the user to the protected area of your app.

When you connect, users authenticate through the OAuth 2.0 flow you configured. Verify that protected routes require a valid session and that the logout endpoint properly clears session state.