Skip to content
Back to skills

Get Dev Token

ASecurity

Acquire a development OIDC access token through the project's token command or the bundled macOS PKCE script

  • 11 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added August 31, 2026
developmentshellbackend

Works with

  • cli

Security analysis

A100/100

Pro scans all 4 files and shows the line behind each finding

Scanned August 31, 2026

npx -y skills add johnkozaris/jko-claude-plugins --skill get-dev-token --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Get Dev Token?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Get Dev Token
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/johnkozaris-get-dev-token/badge)](https://www.skillsdirectory.com/skills/johnkozaris-get-dev-token)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: get-dev-token
description: Acquire a development OIDC access token through the project's token command or the bundled macOS PKCE script
user-invocable: true
---

# Get Development Token

Use `TOKEN_COMMAND` when the project defines one. Otherwise prefer the
repository convention `scripts/get-backend-token.sh`; if absent, scaffold it
from
`${CLAUDE_PLUGIN_ROOT}/skills/get-dev-token/references/token-script.sh`
after confirming provider/client configuration.

Capture the script's stdout into a shell variable; never surface the token in
the response. Issuer URLs and public-client IDs follow repository configuration
policy rather than a blanket secret rule.

If the access token is JWT-shaped, inspect claims with the bundled
`scripts/decode-jwt.sh` in this skill directory; call this inspection, not
verification. Compare the identity and policy claims with the backend
configuration.

Load `references/oidc-token-flows.md` when grant selection, discovery, refresh,
or a 401 requires deeper diagnosis.

If the wrong browser identity was cached, delete only the matching Keychain
entry using both service and client account.

Files in this skill

  • SKILL.md1.1 KB
  • references/oidc-token-flows.md1.7 KB
  • references/token-script.sh5 KB
  • scripts/decode-jwt.sh810 B

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.