-
-
-2. ## Generate authentication implementation
-
- Use a structured prompt to direct the coding agent. A well-formed prompt ensures the agent generates complete, production-ready Agent Auth code that includes all required security components.
-
- Copy the following prompt into your coding agent:
-
- ```md wrap showLineNumbers=false title="Authentication implementation prompt"
- Guide me through configuring the installed Scalekit marketplace plugin to handle agent authentication for Gmail. Provide the code to trigger the auth flow, retrieve the secure user token, and then use that authenticated session to fetch and list the last 5 unread emails. Add logging to verify the flow.
- ```
-
- When you submit this prompt, Claude Code loads the Agent Auth skill from the marketplace -> analyzes your existing application structure -> generates Scalekit client initialization -> creates connected account management functions -> implements OAuth authorization link generation -> adds token fetching and refresh logic.
-
-
-
-3. ## Verify just-in-time implementation
-
- After the coding agent completes, verify that all authentication components are properly configured:
-
- Check generated files:
- - Scalekit client initialization with credentials. You may need to set up a `.env` file with your Scalekit API credentials.
- - Connected account management functions
- - Authorization link generation
- - Token fetching and storage
- - Error handling for expired tokens
-
- The authorization flow should redirect users to the service's consent page, where they grant permissions. Your application should then be able to fetch OAuth tokens and execute actions on behalf of the authenticated user.
-
-Alternative: Enable authentication plugins via plugin wizard
- - Run the plugin wizard to browse and enable available plugins: - - ```bash title="Claude REPL" showLineNumbers=false - /plugins - ``` - - Navigate through the visual interface to enable the Agent Auth plugin. - - - -
-
-
-3. ## Generate authentication implementation
-
- Use a structured prompt to direct GitHub Copilot. A well-formed prompt ensures the agent generates complete, production-ready Agent Auth code that includes all required security components.
-
- Copy the following command into your terminal:
-
- ```bash wrap title="Terminal" frame="terminal" showLineNumbers=false
- copilot "Configure Scalekit agent authentication for Gmail — provide the code to trigger the auth flow, retrieve the secure user token, and then use that authenticated session to fetch and list the last 5 unread emails. Add logging to verify the flow."
- ```
-
- GitHub Copilot uses the Agent Auth plugin to analyze your existing application structure, generate Scalekit client initialization code, create connected account management functions, implement OAuth authorization link generation, and add token fetching and refresh logic.
-
-
-
-4. ## Verify the implementation
-
- After GitHub Copilot completes, verify that all authentication components are properly configured:
-
- Check generated files:
- - Scalekit client initialization with credentials (you may need to set up a `.env` file with your Scalekit API credentials)
- - Connected account management functions
- - Authorization link generation
- - Token fetching and storage
- - Error handling for expired tokens
-
- The authorization flow should redirect users to the service's consent page, where they grant permissions. Your application should then be able to fetch OAuth tokens and execute actions on behalf of the authenticated user.
-
-Verify the plugin is installed
- - Confirm the plugin installed successfully: - - ```bash title="Terminal" frame="terminal" showLineNumbers=false - copilot plugin list - ``` - - - -
-
-
-2. ## Generate authentication implementation
-
- Use a structured prompt to direct the coding agent. A well-formed prompt ensures the agent generates complete, production-ready Full Stack Auth code that includes all required security components.
-
- Copy the following prompt into your coding agent:
-
- ```md wrap showLineNumbers=false title="Authentication implementation prompt"
- Guide the coding agent to implement Scalekit full-stack auth — initialize ScalekitClient with environment credentials, implement the login redirect, handle the OAuth callback to exchange the code for tokens, store the session securely, and add a logout endpoint that clears the session. Code only.
- ```
-
- When you submit this prompt, Claude Code loads the Full Stack Auth skill from the marketplace -> analyzes your existing application structure -> generates Scalekit client initialization with environment credentials -> creates the login redirect handler -> implements the OAuth callback to exchange the authorization code for tokens -> adds secure session storage and a logout endpoint.
-
-
-
-3. ## Verify the implementation
-
- After the coding agent completes, verify that all authentication components are properly configured:
-
- Check generated files:
- - Scalekit client initialization with environment credentials (you may need to set up a `.env` file with your Scalekit API credentials)
- - Login route that redirects to Scalekit's authorization endpoint
- - OAuth callback route that exchanges the code for tokens
- - Secure session storage with proper cookie attributes
- - Logout endpoint that clears the session
-
- The login flow should redirect users to Scalekit's authorization page, where they authenticate. Your application should then exchange the returned authorization code for tokens, store the session, and redirect the user to the protected area of your app.
-
-Alternative: Enable authentication plugins via plugin wizard
- - Run the plugin wizard to browse and enable available plugins: - - ```bash title="Claude REPL" showLineNumbers=false - /plugins - ``` - - Navigate through the visual interface to enable the Full Stack Auth plugin. - - - -
-
-
-3. ## Generate authentication implementation
-
- Use a structured prompt to direct GitHub Copilot. A well-formed prompt ensures the agent generates complete, production-ready Full Stack Auth code that includes all required security components.
-
- Copy the following command into your terminal:
-
- ```bash wrap title="Terminal" frame="terminal" showLineNumbers=false
- copilot "Implement Scalekit full-stack auth — initialize ScalekitClient with environment credentials, implement the login redirect, handle the OAuth callback to exchange the code for tokens, store the session securely, and add a logout endpoint that clears the session. Code only."
- ```
-
- GitHub Copilot uses the Full Stack Auth plugin to analyze your existing application structure, generate Scalekit client initialization code, create the login redirect handler, implement the OAuth callback for token exchange, add secure session storage, and provide a logout endpoint.
-
-
-
-4. ## Verify the implementation
-
- After GitHub Copilot completes, verify that all authentication components are properly configured:
-
- Check generated files:
- - Scalekit client initialization with environment credentials (you may need to set up a `.env` file with your Scalekit API credentials)
- - Login route that redirects to Scalekit's authorization endpoint
- - OAuth callback route that exchanges the code for tokens
- - Secure session storage with proper cookie attributes
- - Logout endpoint that clears the session
-
- The login flow should redirect users to Scalekit's authorization page, where they authenticate. Your application should then exchange the returned authorization code for tokens, store the session, and redirect the user to the protected area of your app.
-
-Verify the plugin is installed
- - Confirm the plugin installed successfully: - - ```bash title="Terminal" frame="terminal" showLineNumbers=false - copilot plugin list - ``` - - - -
-
-
-2. ## Generate authentication implementation
-
- Use a structured prompt to direct the coding agent. A well-formed prompt ensures the agent generates complete, production-ready authentication code that includes all required security components.
-
- Copy the following prompt into your coding agent:
-
- ```md wrap showLineNumbers=false title="Authentication implementation prompt"
- Add OAuth 2.1 authentication to my MCP server using Scalekit. Initialize ScalekitClient with environment credentials, implement /.well-known/ metadata endpoint for discovery, and add authentication middleware that validates JWT bearer tokens on all MCP requests. Code only.
- ```
-
- When you submit this prompt, Claude Code loads the MCP authentication skill from the marketplace -> analyzes your existing MCP server structure -> generates authentication middleware with token validation -> creates the OAuth discovery endpoint -> configures environment variable handling.
-
- Alternative: Enable authentication plugins via plugin wizard
- - Run the plugin wizard to browse and enable available plugins: - - ```bash title="Claude REPL" showLineNumbers=false - /plugins - ``` - - Navigate through the visual interface to enable the MCP authentication plugin: - -
-
-
-3. ## Generate authentication implementation
-
- Use a structured prompt to direct GitHub Copilot. A well-formed prompt ensures the agent generates complete, production-ready authentication code that includes all required security components.
-
- Copy the following command into your terminal:
-
- ```bash wrap title="Terminal" frame="terminal" showLineNumbers=false
- copilot "Add OAuth 2.1 authentication to my MCP server using Scalekit. Initialize ScalekitClient with environment credentials, implement /.well-known/ metadata endpoint for discovery, and add authentication middleware that validates JWT bearer tokens on all MCP requests. Code only."
- ```
-
- GitHub Copilot uses the MCP Auth plugin to analyze your existing MCP server structure, generate authentication middleware with token validation, create the OAuth discovery endpoint, and configure environment variable handling.
-
-
-
-4. ## Verify the implementation
-
- After GitHub Copilot completes, verify that all authentication components are properly configured:
-
- Check generated files:
- - Authentication middleware with JWT validation
- - Environment variable configuration (`.env.example`)
- - OAuth discovery endpoint (`/.well-known/oauth-authorization-server`)
- - Error handling for invalid or expired tokens
-
- Test the authentication flow:
-
- ```bash title="Terminal" frame="terminal"
- # Start your MCP server
- npm start
-
- # Test discovery endpoint
- curl http://localhost:3000/.well-known/oauth-authorization-server
-
- # Test protected endpoint (should return 401)
- curl http://localhost:3000/mcp
-
- # Test with valid token
- curl -H "Authorization: Bearer YOUR_TOKEN" http://localhost:3000/mcp
- ```
-
- The discovery endpoint should return OAuth configuration metadata. Protected endpoints should reject requests without valid tokens and accept requests with properly scoped access tokens.
-
-Verify the plugin is installed
- - Confirm the plugin installed successfully: - - ```bash title="Terminal" frame="terminal" showLineNumbers=false - copilot plugin list - ``` - - - -
-
-
-2. ## Generate SCIM implementation
-
- Use a structured prompt to direct the coding agent. A well-formed prompt ensures the agent generates complete, production-ready SCIM code that includes all required security components.
-
- Copy the following prompt into your coding agent:
-
- ```md wrap showLineNumbers=false title="SCIM implementation prompt"
- Guide the coding agent to add Scalekit SCIM directory sync to my app — set up the webhook endpoint to receive SCIM events, validate the webhook signature, and handle user provisioning and deprovisioning events to create, update, and delete users in my database. Code only.
- ```
-
- When you submit this prompt, Claude Code loads the Modular SCIM skill from the marketplace -> analyzes your existing application structure -> generates a webhook endpoint to receive SCIM events from Scalekit -> implements webhook signature validation to prevent unauthorized requests -> creates handlers for user provisioning events (create and update) -> adds deprovisioning logic to delete or deactivate users in your database.
-
-
-
-3. ## Verify the implementation
-
- After the coding agent completes, verify that all SCIM components are properly configured:
-
- Check generated files:
- - Webhook endpoint that receives SCIM events from Scalekit (you may need to set up a `.env` file with your Scalekit webhook secret)
- - Webhook signature validation to authenticate incoming requests
- - User provisioning handler that creates or updates users in your database
- - Deprovisioning handler that deletes or deactivates users when they are removed from the identity provider
-
- The SCIM flow should receive webhook events from Scalekit when users are added, updated, or removed in the connected identity provider. Your application should validate each event's signature, then apply the corresponding change to your user database.
-
-Alternative: Enable SCIM plugins via plugin wizard
- - Run the plugin wizard to browse and enable available plugins: - - ```bash title="Claude REPL" showLineNumbers=false - /plugins - ``` - - Navigate through the visual interface to enable the Modular SCIM plugin. - - - -
-
-
-3. ## Generate SCIM implementation
-
- Use a structured prompt to direct GitHub Copilot. A well-formed prompt ensures the agent generates complete, production-ready SCIM code that includes all required security components.
-
- Copy the following command into your terminal:
-
- ```bash wrap title="Terminal" frame="terminal" showLineNumbers=false
- copilot "Add Scalekit SCIM directory sync to my app — set up the webhook endpoint to receive SCIM events, validate the webhook signature, and handle user provisioning and deprovisioning events to create, update, and delete users in my database. Code only."
- ```
-
- GitHub Copilot uses the Modular SCIM plugin to analyze your existing application structure, generate a webhook endpoint to receive SCIM events from Scalekit, implement webhook signature validation to prevent unauthorized requests, create handlers for user provisioning events (create and update), and add deprovisioning logic to delete or deactivate users in your database.
-
-
-
-4. ## Verify the implementation
-
- After GitHub Copilot completes, verify that all SCIM components are properly configured:
-
- Check generated files:
- - Webhook endpoint that receives SCIM events from Scalekit (you may need to set up a `.env` file with your Scalekit webhook secret)
- - Webhook signature validation to authenticate incoming requests
- - User provisioning handler that creates or updates users in your database
- - Deprovisioning handler that deletes or deactivates users when they are removed from the identity provider
-
- The SCIM flow should receive webhook events from Scalekit when users are added, updated, or removed in the connected identity provider. Your application should validate each event's signature, then apply the corresponding change to your user database.
-
-Verify the plugin is installed
- - Confirm the plugin installed successfully: - - ```bash title="Terminal" frame="terminal" showLineNumbers=false - copilot plugin list - ``` - - - -
-
-
-2. ## Generate SSO implementation
-
- Use a structured prompt to direct the coding agent. A well-formed prompt ensures the agent generates complete, production-ready SSO code that includes all required security components.
-
- Copy the following prompt into your coding agent:
-
- ```md wrap showLineNumbers=false title="SSO implementation prompt"
- Guide the coding agent to add Scalekit SSO to my existing app — initialize ScalekitClient, generate an SSO authorization URL for a given organization, handle the SSO callback to validate and exchange the code for user identity, and integrate the SSO user into my existing session system. Code only.
- ```
-
- When you submit this prompt, Claude Code loads the Modular SSO skill from the marketplace -> analyzes your existing application structure -> generates Scalekit client initialization with environment credentials -> creates an SSO authorization URL generator for organization-based routing -> implements the SSO callback handler to validate and exchange the code for user identity -> integrates SSO user data into your existing session system.
-
-
-
-3. ## Verify the implementation
-
- After the coding agent completes, verify that all SSO components are properly configured:
-
- Check generated files:
- - Scalekit client initialization with environment credentials (you may need to set up a `.env` file with your Scalekit API credentials)
- - SSO authorization URL generation for organization-based routing
- - SSO callback handler that validates the authorization code and retrieves user identity
- - Integration logic that maps SSO user identity into your existing session system
-
- The SSO flow should redirect users to their organization's identity provider, where they authenticate. Your application should then receive the callback, validate the code, extract the user's identity, and create or update the user session accordingly.
-
-Alternative: Enable authentication plugins via plugin wizard
- - Run the plugin wizard to browse and enable available plugins: - - ```bash title="Claude REPL" showLineNumbers=false - /plugins - ``` - - Navigate through the visual interface to enable the Modular SSO plugin. - - - -
-
-
-3. ## Generate SSO implementation
-
- Use a structured prompt to direct GitHub Copilot. A well-formed prompt ensures the agent generates complete, production-ready SSO code that includes all required security components.
-
- Copy the following command into your terminal:
-
- ```bash wrap title="Terminal" frame="terminal" showLineNumbers=false
- copilot "Add Scalekit SSO to my existing app — initialize ScalekitClient, generate an SSO authorization URL for a given organization, handle the SSO callback to validate and exchange the code for user identity, and integrate the SSO user into my existing session system. Code only."
- ```
-
- GitHub Copilot uses the Modular SSO plugin to analyze your existing application structure, generate Scalekit client initialization code, create an SSO authorization URL generator for organization-based routing, implement the SSO callback handler to validate and exchange the code for user identity, and integrate SSO user data into your existing session system.
-
-
-
-4. ## Verify the implementation
-
- After GitHub Copilot completes, verify that all SSO components are properly configured:
-
- Check generated files:
- - Scalekit client initialization with environment credentials (you may need to set up a `.env` file with your Scalekit API credentials)
- - SSO authorization URL generation for organization-based routing
- - SSO callback handler that validates the authorization code and retrieves user identity
- - Integration logic that maps SSO user identity into your existing session system
-
- The SSO flow should redirect users to their organization's identity provider, where they authenticate. Your application should then receive the callback, validate the code, extract the user's identity, and create or update the user session accordingly.
-
-Verify the plugin is installed
- - Confirm the plugin installed successfully: - - ```bash title="Terminal" frame="terminal" showLineNumbers=false - copilot plugin list - ``` - - - -
+ {
+ !hideCommand && (
+
+
+
diff --git a/src/configs/agent-instructions.ts b/src/configs/agent-instructions.ts
index c8a0e6996..4ae40561a 100644
--- a/src/configs/agent-instructions.ts
+++ b/src/configs/agent-instructions.ts
@@ -1,43 +1,28 @@
/**
- * Plugin installation instructions for AI coding agents.
+ * Unified CLI setup instructions for AI coding agents.
* Single source of truth — used across page-actions prompt, llms.txt, copy-markdown button, and meta tag.
*/
/** HTML comment prepended to copied markdown — read by agents that receive raw page content. */
export const AGENT_PLUGIN_HEADER = `
`
/** Plain-text block for the page-actions prompt (injected into "Open in Claude/Cursor" messages). */
export const AGENT_PLUGIN_INLINE = `Building with AI coding agents?
-If you're using an AI coding agent, install the official Scalekit plugin. It gives your agent full awareness of the Scalekit API — reducing hallucinations and enabling faster, more accurate code generation.
+Install the Scalekit Auth Stack with a single command:
-Claude Code: claude plugin marketplace add scalekit-inc/claude-code-authstack && claude plugin install
+ {
+ agents.map(({ key, label }) => {
+ const Icon = getIconComponent(key)
+ return (
+
+
+ {label}
+
+ )
+ })
+ }
+
+
diff --git a/src/content/docs/authenticate/sso/add-modular-sso.mdx b/src/content/docs/authenticate/sso/add-modular-sso.mdx
index 44aed9898..9608962d1 100644
--- a/src/content/docs/authenticate/sso/add-modular-sso.mdx
+++ b/src/content/docs/authenticate/sso/add-modular-sso.mdx
@@ -14,6 +14,7 @@ import {
} from '@astrojs/starlight/components';
import FoldCard from '@components/ui/FoldCard.astro';
import Tabs from '@components/ui/Tabs.astro';
+import SupportedAgents from '@components/ui/SupportedAgents.astro';
import InstallSDK from '@components/templates/_installsdk.mdx';
import SimpleCode from '@components/ui/SimpleCode.astro';
import IconLucidePlay from '~icons/lucide/play'
@@ -54,8 +55,8 @@ Choose Modular SSO when you:
- Need to integrate SSO without changing your existing authentication architecture
- Already have existing user management infrastructure
-