netlify-identity

This skill guides an agent through adding authentication and user management to a Netlify site using the `@netlify/identity` package. It covers signup/login/logout, OAuth social login (Google, GitHub, GitLab, Bitbucket), server-side user verification in Functions, role-based access control, admin user management, and Identity event hooks. It solves the recurring problem of wiring up auth on Netlify correctly by steering away from the legacy widget and gotrue-js and toward the modern package's simpler API and built-in server-side support.

Much of the value is in its security-conscious "footguns" guidance. It warns that Identity does not work under `netlify dev` (test on a deploy preview), that building a from-scratch third-party OAuth flow beside Identity is the most common source of rework (use `oauthLogin()` and `handleAuthCallback()` instead), and that Identity settings are dashboard-only with no public API to curl or token files to read. It emphasizes CSRF protection via `verifyRequestOrigin()` for server-side auth mutations, mandatory callback handling, and rendering providers from `getSettings()` rather than hard-coding them. Reference files go deep on authorization and sessions: admin operations run only in the Functions runtime with a runtime-provided token (never hardcoded or shipped client-side), redirect gating is only a coarse CDN-level perimeter that SPA navigation bypasses, sensitive checks must be enforced server-side against server-controlled app_metadata.roles, and role changes do not affect live sessions until the JWT refreshes. Advanced patterns cover password recovery, invite acceptance, email change, session hydration, and SSR integration.

It targets web developers building login/signup flows, social login, role-gated content, or protected functions on Netlify. It explicitly defers whole-site locking to a separate netlify-access-control skill.