Coding agents: Add SSO to your app

Use AI coding agents like Claude Code, GitHub Copilot CLI, Cursor, and OpenCode to add Scalekit’s Modular SSO to your existing applications. Configure the agents to analyze your codebase, apply SSO patterns, and generate production-ready code that integrates enterprise identity providers. This follows security best practices while reducing implementation time from hours to minutes.

Claude Code

1. Install the authstack plugin

   Not yet on Claude Code? Follow the official quickstart guide to install it.

   Terminal

   npx @scalekit-inc/cli setup

   For repeated use:

   Terminal

   npm install -g @scalekit-inc/cli
   scalekit setup

   The CLI installs the authstack plugin for you. The plugins guide the coding agent to generate implementation code that matches your project structure.

   Alternative: Enable authentication plugins via plugin wizard

   Run the plugin wizard to browse and enable available plugins:

   Claude REPL

   /plugins

   Navigate through the visual interface to enable the Modular SSO plugin.

   Auto-update recommendations

   Enable auto-updates for authentication plugins to receive security patches and improvements. Scalekit regularly updates plugins based on community feedback and security best practices.

2. Generate SSO implementation

   Use a structured prompt to direct the coding agent. A well-formed prompt ensures the agent generates complete, production-ready SSO code that includes all required security components.

   Copy the following prompt into your coding agent:

   SSO implementation prompt

   Guide the coding agent to add Scalekit SSO to my existing app — initialize ScalekitClient, generate an SSO authorization URL for a given organization, handle the SSO callback to validate and exchange the code for user identity, and integrate the SSO user into my existing session system. Code only.

   When you submit this prompt, Claude Code loads the Modular SSO skill from the marketplace -> analyzes your existing application structure -> generates Scalekit client initialization with environment credentials -> creates an SSO authorization URL generator for organization-based routing -> implements the SSO callback handler to validate and exchange the code for user identity -> integrates SSO user data into your existing session system.

   Review generated code

   Always review AI-generated authentication code before deployment. Verify that environment variables, token validation logic, and error handling match your security requirements. The coding agent provides a foundation, but you must ensure it aligns with your application’s specific needs.

3. Verify the implementation

   After the coding agent completes, verify that all SSO components are properly configured:

   Check generated files:

   • Scalekit client initialization with environment credentials (you may need to set up a .env file with your Scalekit API credentials)
   • SSO authorization URL generation for organization-based routing
   • SSO callback handler that validates the authorization code and retrieves user identity
   • Integration logic that maps SSO user identity into your existing session system

   The SSO flow should redirect users to their organization’s identity provider, where they authenticate. Your application should then receive the callback, validate the code, extract the user’s identity, and create or update the user session accordingly.

When users authenticate through SSO, your application receives verified identity claims from the identity provider. Verify that the SSO callback correctly maps user identity to your application’s user model and that the session is created with the appropriate access level.

Codex

1. Install the authstack plugin (recommended)

   Terminal

   npx @scalekit-inc/cli setup

   For repeated use, install globally:

   Terminal

   npm install -g @scalekit-inc/cli
   scalekit setup

   Choose Codex when prompted. The CLI installs the authstack plugin.

2. Enable the Modular SSO plugin

   Restart Codex, then open the Plugin Directory and enable the authstack plugin.

   Install the modular-sso plugin. This plugin includes the workflows, references, and prompts Codex uses to generate SAML and OIDC SSO code for your existing application.

3. Generate the SSO implementation

   Use a structured prompt to direct Codex. A well-formed prompt helps Codex generate complete, production-ready SSO code that includes all required security components.

   Copy the following prompt into Codex:

   SSO implementation prompt

   Guide the coding agent to add Scalekit SSO to my existing app — initialize ScalekitClient, generate an SSO authorization URL for a given organization, handle the SSO callback to validate and exchange the code for user identity, and integrate the SSO user into my existing session system. Code only.

   When you submit this prompt, Codex loads the Modular SSO plugin from the authstack plugin, analyzes your existing application structure, generates Scalekit client initialization with environment credentials, creates an SSO authorization URL generator for organization-based routing, implements the SSO callback handler to validate and exchange the code for user identity, and integrates SSO user data into your existing session system.

   Review generated code

   Always review AI-generated authentication code before deployment. Verify that environment variables, token validation logic, and error handling match your security requirements. The coding agent provides a foundation, but you must ensure it aligns with your application’s specific needs.

4. Verify the implementation

   After Codex completes, verify that all SSO components are properly configured:

   Check generated files:

   • Scalekit client initialization with environment credentials. You may need to set up a .env file with your Scalekit API credentials.
   • SSO authorization URL generation for organization-based routing
   • SSO callback handler that validates the authorization code and retrieves user identity
   • Integration logic that maps SSO user identity into your existing session system

   The SSO flow should redirect users to their organization’s identity provider, where they authenticate. Your application should then receive the callback, validate the code, extract the user’s identity, and create or update the user session accordingly.

When users authenticate through SSO, your application receives verified identity claims from the identity provider. Verify that the SSO callback correctly maps user identity to your application’s user model and that the session is created with the appropriate access level.

GitHub Copilot CLI

1. Install the authstack plugin (recommended)

   Need to install GitHub Copilot CLI? See the getting started guide — an active GitHub Copilot subscription is required.

   Terminal

   npx @scalekit-inc/cli setup

   For repeated use, install globally:

   Terminal

   npm install -g @scalekit-inc/cli
   scalekit setup

   The CLI installs the authstack plugin for GitHub Copilot.

   Tool-native alternative

   copilot plugin marketplace add scalekit-inc/authstack
   copilot plugin install agentkit@authstack
   copilot plugin install saaskit@authstack

   Verify the plugin is installed

   Confirm the plugin installed successfully:

   Terminal

   copilot plugin list

2. Generate SSO implementation

   Use a structured prompt to direct GitHub Copilot. A well-formed prompt ensures the agent generates complete, production-ready SSO code that includes all required security components.

   Copy the following command into your terminal:

   Terminal

   copilot "Add Scalekit SSO to my existing app — initialize ScalekitClient, generate an SSO authorization URL for a given organization, handle the SSO callback to validate and exchange the code for user identity, and integrate the SSO user into my existing session system. Code only."

   GitHub Copilot uses the Modular SSO plugin to analyze your existing application structure, generate Scalekit client initialization code, create an SSO authorization URL generator for organization-based routing, implement the SSO callback handler to validate and exchange the code for user identity, and integrate SSO user data into your existing session system.

   Review generated code

   Always review AI-generated authentication code before deployment. Verify that environment variables, token validation logic, and error handling match your security requirements. The coding agent provides a foundation, but you must ensure it aligns with your application’s specific needs.

3. Verify the implementation

   After GitHub Copilot completes, verify that all SSO components are properly configured:

   Check generated files:

   • Scalekit client initialization with environment credentials (you may need to set up a .env file with your Scalekit API credentials)
   • SSO authorization URL generation for organization-based routing
   • SSO callback handler that validates the authorization code and retrieves user identity
   • Integration logic that maps SSO user identity into your existing session system

   The SSO flow should redirect users to their organization’s identity provider, where they authenticate. Your application should then receive the callback, validate the code, extract the user’s identity, and create or update the user session accordingly.

When users authenticate through SSO, your application receives verified identity claims from the identity provider. Verify that the SSO callback correctly maps user identity to your application’s user model and that the session is created with the appropriate access level.

Cursor

1. Install the authstack plugin (recommended)

   Terminal

   npx @scalekit-inc/cli setup

   For repeated use, install globally:

   Terminal

   npm install -g @scalekit-inc/cli
   scalekit setup

   The CLI detects Cursor and installs the authstack plugin directly.

2. Reload and select plugins

   Restart Cursor (or run Developer: Reload Window), then open Settings > Cursor Settings > Plugins.

   Enable the Scalekit plugins you need (AgentKit, SaaSKit, etc.).

   Alternative for other agents

   For 40+ agents (Windsurf, Cline, etc.) or to install skills manually, the CLI also offers the skills option, or run:

   npx skills add scalekit-inc/authstack

3. Generate the implementation

   Open Cursor’s chat panel with Cmd+L (macOS) or Ctrl+L (Windows/Linux) and paste in an implementation prompt from the feature page (or describe what you need in natural language). The installed Scalekit plugins provide the agent with accurate patterns.

   Review generated code

   Always review AI-generated authentication code before deployment. Verify that environment variables, token validation logic, and error handling match your application’s security requirements.

4. Verify the implementation

   After Cursor finishes generating code, confirm all authentication components are in place:

   • The Scalekit plugin appears in Settings > Cursor Settings > Plugins
   • Scalekit client initialized with your API credentials (set up a .env file with your Scalekit environment variables)
   • Authorization URL generation and callback handler
   • Session or token integration matching your application’s existing patterns

40+ agents

The authstack plugin works with 40+ AI agents. Skills are installed via the Scalekit CLI or the Vercel Skills CLI.

The easiest way for most developers is:

Terminal

npx @scalekit-inc/cli setup

For repeated use, install globally:

Terminal

npm install -g @scalekit-inc/cli
scalekit setup

Then choose the “Other agents” / skills option when prompted.

You can also install the skills directly:

1. Install interactively

   Run the command with no flags to be guided through the available skills:

   Terminal

   npx skills add scalekit-inc/authstack

2. Browse and install a specific skill

   Install the skill for your auth type (for example, MCP OAuth):

   Terminal

   # List all available skills
   npx skills add scalekit-inc/authstack --list
   
   # Install a specific skill
   npx skills add scalekit-inc/authstack --skill adding-mcp-oauth

3. Invoke the skill Varies by agent

   Each coding agent has its own behavior for invoking skills. In OpenCode, skills are invoked automatically by the agent based on natural language — no slash commands required. The agent has a list of available skills and their description fields in context. It reads your intent, matches it against those descriptions, and autonomously calls the skill tool to load the relevant SKILL.md. A clear, specific description in skill frontmatter is what the agent uses to decide which skill to invoke.

   Flow in practice:

   • You write a natural language message to the agent
   • The agent checks its context — it already sees <available_skills> with names and descriptions
   • If your request matches a skill’s purpose, the agent calls skill("<name>") internally
   • The full SKILL.md content loads into context and the agent follows those instructions

   If your agent does not automatically pick up skills, you can run a command to load a skill and manually select Scalekit’s skills to load into context. Refer to your favorite coding agent’s documentation for how to invoke skills once they are installed.

4. Install all skills globally

   To add all Scalekit authentication skills to your agents:

   Terminal

   npx skills add scalekit-inc/authstack --all --global

   This installs all AgentKit and SaaSKit skills.