SKILL-049 Authentication and account lifecycle Locked skill

Login

Verify the password against a slow hash, then regenerate the session — a successful login must never reuse the pre-login session ID.

01

What this skill helps you build

Authenticate a returning user with email and password, then mint a fresh, secure session they carry on every request.

The production takeaway

Verify the password against a slow hash, then regenerate the session — a successful login must never reuse the pre-login session ID.

02

Inside this skill

The full skill expands these implementation areas with decisions, edge cases, prompts, tests, and framework-specific code.

Authentication and account lifecycle
What this helps you build

The everyday front door of your app: a password login that takes an email and a password, checks them against a stored hash, and — on success — creates a fresh session the browser

🔒
Authentication and account lifecycle
When to use this

Use this whenever users have a password and need to come back to an existing account. Concretely, reach for this flow when you have: A returning user sign in form email + password

🔒
Authentication and account lifecycle
The core idea

Login is two steps that must stay distinct: verify , then establish identity . First you verify the credential. You never compare passwords directly — you run the submitted passwor

🔒
03

Unlock the full implementation

Paid access includes the complete skill body, implementation prompt, common mistakes, production checklist, and code examples where this skill includes them.