catalyst-authentication
Catalyst Authentication — user login/signup, ZAID, Web SDK auth flows, and OAuth token management via Connections. Trigger on 'authentication', 'login', 'signup', 'getCurrentUser', 'ZAID', 'isUserAuthenticated', 'signOut', 'Connections', or 'getAccessToken'. You MUST load this skill whenever implementing user login or protecting data — ZAID differs between Development and Production and is the #1 cause of auth failures after environment promotion. For Security Rules (function invocation control), route to catalyst-functions.
How do I install this agent skill?
npx skills add https://github.com/catalystbyzoho/agent-skills --skill catalyst-authenticationIs this agent skill safe to install?
- Gen Agent Trust Hubpass
The skill provides comprehensive guidance on implementing authentication, user management, and OAuth token handling using the Zoho Catalyst platform. It emphasizes best practices such as environment-specific configuration (ZAID), proper SDK initialization scopes, and secure handling of credentials in client-side requests. No security vulnerabilities or malicious patterns were detected.
- Socketpass
No alerts
- Snykpass
Risk: LOW · No issues
What does this agent skill do?
How It Works
- Identify flow type — Hosted login (redirect to Catalyst login page), embedded login (custom UI), or backend
getCurrentUsercheck. - Load
references/auth-basics.md— for signup/login flows, ZAID gotcha, hosted vs embedded login, and common auth errors. - ZAID warning — ZAID differs between Development and Production. This is the #1 auth issue in production. Always verify the environment.
- Security Rules — If the query involves controlling who can invoke a function, route to
catalyst-functionsskill and itsreferences/functions-basics.mdSecurity Rules section. Security Rules has two parameters: (a)methods— which HTTP methods (GET/POST/PUT/DELETE/PATCH) are enabled for the function (removing a method blocks that verb entirely), and (b)authentication— a single binary flag (optional= public,required= authenticated users only) applied function-wide, not per-method. For role-based data access control, route to DataStore Scopes and Permissions (Console → Table → Scopes and Permissions). - OAuth / Connections — Load
references/connections.mdfor external API OAuth token management (Zoho or third-party).
Security Checklist
- ZAID is environment-specific. The Development ZAID is different from the Production ZAID. Social logins (Google, Facebook, LinkedIn, Microsoft) configured in Development MUST be reconfigured with the Production ZAID and production app domain before going live — using the wrong ZAID causes all social logins to silently fail in production.
- DataStore permissions are separate from function-level auth. Requiring authentication in Security Rules only controls who can call the function. App User table permissions (Console → Table → Scopes and Permissions) separately control which DataStore operations authenticated users can perform.
Triggers
Use this skill for: "authentication", "user management", "login", "signup", getCurrentUser, "ZAID", registerUser, isUserAuthenticated, signOut, "hosted login", "embedded login", "Connections", "OAuth token", getConnector, getAccessToken, "Security Rules", "App User", "credentials include", or "auth redirect".
References
| Reference | Load when the query is about… |
|---|---|
references/auth-basics.md | User signup/login, getCurrentUser, Web SDK auth flows, ZAID gotcha, hosted vs embedded login, common auth errors |
catalyst-functions skill | Security Rules — function invocation control (methods, authentication: optional/required) |
references/connections.md | OAuth token management for external APIs — getConnector, getAccessToken, Zoho and third-party service connections |
How can the creator link this skill?
Add the canonical catalog link to the repository README so users can inspect current installs and available audits. The publishing guide covers the complete discovery path.
<a href="https://skillzs.dev/skills/catalystbyzoho/agent-skills/catalyst-authentication">View catalyst-authentication on skillZs</a>