@frontmcp/skills 1.0.0-beta.9 → 1.0.0

package/README.md

@@ -39,14 +39,14 @@ export default class Server {}
 
 ## Installation
 
-**Node.js 22+** required (24 recommended).
+**Node.js 24+** required.
 
 ```bash
 # New project (recommended)
 npx frontmcp create my-app
 
 # Existing project
-npm i -D frontmcp @types/node@^22
+npm i -D frontmcp @types/node@^24
 npx frontmcp init
 ```
 

package/catalog/TEMPLATE.md

@@ -88,6 +88,75 @@ Continue with subsequent steps.
 | -------------------- | -------------- | ------------- |
 | Common error message | Why it happens | How to fix it |
 
+## Examples
+
+Each reference file has a corresponding `examples/<reference-name>/` directory with standalone, copy-pasteable examples.
+
+### Example file structure
+
+````markdown
+---
+name: example-name
+reference: parent-reference-name
+level: basic | intermediate | advanced
+description: One sentence describing the exact scenario this example covers.
+tags: [keyword1, keyword2, keyword3]
+features:
+  - Concrete API or pattern this example demonstrates
+  - Another concrete behavior shown in the code
+---
+
+# Example Title
+
+One sentence expanding slightly on the frontmatter description.
+
+## Code
+
+\```typescript
+// src/path/to/file.ts
+import { ... } from '@frontmcp/sdk';
+// Complete, self-contained code
+\```
+
+## What This Demonstrates
+
+- Key pattern or API shown
+
+## Related
+
+- See `reference-name` for the full API reference
+````
+
+Use the example file frontmatter as the single source of truth for example metadata. Reference `## Examples` tables and `skills-manifest.json` should mirror `name`, `level`, `description`, `tags`, and `features` from the example file.
+
+### Linking from references
+
+Add a `## Examples` section at the bottom of each reference file (before `## Reference`):
+
+```markdown
+## Examples
+
+| Example                                                      | Level | Description   |
+| ------------------------------------------------------------ | ----- | ------------- |
+| [`example-name`](../examples/reference-name/example-name.md) | Basic | What it shows |
+
+> See all examples in [`examples/reference-name/`](../examples/reference-name/)
+```
+
+## Resource Access
+
+Skills are accessible via the `skills://` URI scheme as MCP resources with auto-complete:
+
+| URI                                               | Returns                                   |
+| ------------------------------------------------- | ----------------------------------------- |
+| `skills://catalog`                                | JSON list of all available skills         |
+| `skills://{skillName}`                            | Full SKILL.md content (formatted for LLM) |
+| `skills://{skillName}/SKILL.md`                   | Same as above (explicit path alias)       |
+| `skills://{skillName}/references`                 | JSON list of references for this skill    |
+| `skills://{skillName}/references/{referenceName}` | Reference markdown content                |
+| `skills://{skillName}/examples`                   | JSON list of examples for this skill      |
+| `skills://{skillName}/examples/{exampleName}`     | Example markdown content                  |
+
 ## Reference
 
 - [Documentation](https://docs.agentfront.dev/frontmcp/...)

package/catalog/frontmcp-config/SKILL.md

@@ -1,12 +1,15 @@
 ---
 name: frontmcp-config
-description: "Domain router for configuring MCP servers \u2014 transport, HTTP, throttle, elicitation, auth, sessions, and storage. Use when configuring any aspect of a FrontMCP server."
+description: 'Use when you want to configure auth, set up CORS, add rate limiting, throttle requests, manage sessions, choose transport, set HTTP options, add authentication, configure JWT, or set up OAuth. The skill for server CONFIGURATION.'
 tags: [router, config, transport, http, auth, session, redis, sqlite, throttle, guide]
+category: config
+targets: [all]
+bundle: [recommended, full]
 priority: 10
 visibility: both
 license: Apache-2.0
 metadata:
-  docs: https://docs.agentfront.dev/frontmcp/configuration/overview
+  docs: https://docs.agentfront.dev/frontmcp/fundamentals/overview
 ---
 
 # FrontMCP Configuration Router
@@ -38,7 +41,7 @@ Entry point for configuring FrontMCP servers. This skill helps you find the righ
 ## Prerequisites
 
 - A FrontMCP project scaffolded with `frontmcp create` (see `frontmcp-setup`)
-- Node.js 22+ and npm/yarn installed
+- Node.js 24+ and npm/yarn installed
 
 ## Steps
 
@@ -49,16 +52,24 @@ Entry point for configuring FrontMCP servers. This skill helps you find the righ
 
 ## Scenario Routing Table
 
-| Scenario                                                   | Skill                   | Description                                                   |
-| ---------------------------------------------------------- | ----------------------- | ------------------------------------------------------------- |
-| Choose between SSE, Streamable HTTP, or stdio              | `configure-transport`   | Transport protocol selection with distributed session options |
-| Set up CORS, port, base path, or request limits            | `configure-http`        | HTTP server options for Streamable HTTP and SSE transports    |
-| Add rate limiting, concurrency, or IP filtering            | `configure-throttle`    | Server-level and per-tool throttle configuration              |
-| Enable tools to ask users for input                        | `configure-elicitation` | Elicitation schemas, stores, and multi-step flows             |
-| Set up authentication (public, transparent, local, remote) | `configure-auth`        | OAuth flows, credential vault, multi-app auth                 |
-| Configure session storage backends                         | `configure-session`     | Memory, Redis, Vercel KV, and custom session stores           |
-| Add Redis for production storage                           | `setup-redis`           | Docker Redis, Vercel KV, pub/sub for subscriptions            |
-| Add SQLite for local development                           | `setup-sqlite`          | SQLite with WAL mode, migration helpers                       |
+| Scenario                                                       | Skill                                  | Description                                                      |
+| -------------------------------------------------------------- | -------------------------------------- | ---------------------------------------------------------------- |
+| Choose between SSE, Streamable HTTP, or stdio                  | `configure-transport`                  | Transport protocol selection with distributed session options    |
+| Set up CORS, port, base path, or request limits                | `configure-http`                       | HTTP server options for Streamable HTTP and SSE transports       |
+| Add rate limiting, concurrency, or IP filtering                | `configure-throttle`                   | Server-level and per-tool throttle configuration                 |
+| Enable tools to ask users for input                            | `configure-elicitation`                | Elicitation schemas, stores, and multi-step flows                |
+| Set up authentication (public, transparent, local, remote)     | `configure-auth`                       | OAuth flows, credential vault, multi-app auth                    |
+| Configure session storage backends                             | `configure-session`                    | Memory, Redis, Vercel KV, and custom session stores              |
+| Add Redis for production storage                               | `setup-redis`                          | Docker Redis, Vercel KV, pub/sub for subscriptions               |
+| Add SQLite for local development                               | `setup-sqlite`                         | SQLite with WAL mode, migration helpers                          |
+| Understand auth mode details (public/transparent/local/remote) | `configure-auth-modes`                 | Authentication mode details (public, transparent, local, remote) |
+| Fine-tune guard configuration for throttling                   | `configure-throttle-guard-config`      | Advanced guard configuration for throttling                      |
+| Use transport protocol presets                                 | `configure-transport-protocol-presets` | Transport protocol preset configurations                         |
+| Split apps into separate scopes (`splitByApp`)                 | `decorators-guide`                     | Per-app scope and basePath isolation on `@FrontMcp`              |
+| Enable widget-to-host communication (ext-apps)                 | `decorators-guide`                     | `extApps` host capabilities, session validation, widget comms    |
+| Enable background jobs and workflows                           | `decorators-guide`                     | `jobs: { enabled: true, store? }` on `@FrontMcp`                 |
+| Configure pagination for list operations                       | `decorators-guide`                     | `pagination` defaults for `tools/list` endpoint                  |
+| Configure npm/ESM package loader for remote apps               | `decorators-guide`                     | `loader` config for `App.esm()` / `App.remote()` resolution      |
 
 ## Configuration Layers
 
@@ -70,14 +81,19 @@ Server (@FrontMcp)     ← Global defaults
        └── Tool (@Tool) ← Per-tool overrides
 ```
 
-| Setting               | Server       | App | Tool           |
-| --------------------- | ------------ | --- | -------------- |
-| Transport             | Yes          | No  | No             |
-| HTTP (CORS, port)     | Yes          | No  | No             |
-| Throttle (rate limit) | Yes (global) | No  | Yes (per-tool) |
-| Auth mode             | Yes          | Yes | No             |
-| Session store         | Yes          | No  | No             |
-| Elicitation           | No           | No  | Yes (per-tool) |
+| Setting               | Server (`@FrontMcp`)             | App (`@App`)          | Tool (`@Tool`)                              |
+| --------------------- | -------------------------------- | --------------------- | ------------------------------------------- |
+| Transport             | Yes                              | No                    | No                                          |
+| HTTP (CORS, port)     | Yes                              | No                    | No                                          |
+| Throttle (rate limit) | Yes (`throttle` global defaults) | No                    | Yes (`rateLimit`, `concurrency`, `timeout`) |
+| Auth mode             | Yes                              | Yes (override)        | No                                          |
+| Auth providers        | No                               | Yes (`authProviders`) | Yes (`authProviders`)                       |
+| Session store         | Yes                              | No                    | No                                          |
+| Elicitation           | Yes (enable: `elicitation`)      | No                    | Yes (usage: `this.elicit()`)                |
+| ExtApps               | Yes                              | No                    | No                                          |
+| Jobs / Workflows      | Yes (`jobs: { enabled }`)        | No                    | No                                          |
+| Pagination            | Yes                              | No                    | No                                          |
+| SplitByApp            | Yes                              | No                    | No                                          |
 
 ## Cross-Cutting Patterns
 
@@ -136,5 +152,5 @@ Server (@FrontMcp)     ← Global defaults
 
 ## Reference
 
-- [Configuration Overview](https://docs.agentfront.dev/frontmcp/configuration/overview)
+- [FrontMCP Overview](https://docs.agentfront.dev/frontmcp/fundamentals/overview)
 - Related skills: `configure-transport`, `configure-http`, `configure-throttle`, `configure-elicitation`, `configure-auth`, `configure-session`, `setup-redis`, `setup-sqlite`

package/catalog/frontmcp-config/examples/configure-auth/multi-app-auth.md

@@ -0,0 +1,87 @@
+---
+name: multi-app-auth
+reference: configure-auth
+level: advanced
+description: 'Configure a single FrontMCP server with multiple apps, each using a different auth mode -- public for open endpoints and remote for admin endpoints.'
+tags: [config, auth, security, multi-app, remote, multi]
+features:
+  - 'Hosting multiple `@App` instances on a single FrontMCP server with different auth modes'
+  - 'Using `public` mode for open-access endpoints alongside `remote` mode for admin-only endpoints'
+  - 'Isolating tools per app so each security posture governs only its own tools'
+---
+
+# Multi-App Auth with Different Security Postures
+
+Configure a single FrontMCP server with multiple apps, each using a different auth mode -- public for open endpoints and remote for admin endpoints.
+
+## Code
+
+```typescript
+// src/server.ts
+import { FrontMcp, App, Tool, ToolContext } from '@frontmcp/sdk';
+import { z } from 'zod';
+
+@Tool({
+  name: 'public_search',
+  description: 'Search public records',
+  inputSchema: { query: z.string() },
+  outputSchema: { results: z.array(z.string()) },
+})
+class PublicSearchTool extends ToolContext {
+  async execute(input: { query: string }) {
+    return { results: [`Public result: ${input.query}`] };
+  }
+}
+
+@Tool({
+  name: 'admin_config',
+  description: 'Modify server configuration (admin only)',
+  inputSchema: { key: z.string(), value: z.string() },
+  outputSchema: { updated: z.boolean() },
+})
+class AdminConfigTool extends ToolContext {
+  async execute(input: { key: string; value: string }) {
+    // Only authenticated admins can reach this tool
+    return { updated: true };
+  }
+}
+
+@App({
+  name: 'public-api',
+  auth: {
+    mode: 'public',
+    sessionTtl: 3600,
+    anonymousScopes: ['read'],
+  },
+  tools: [PublicSearchTool],
+})
+class PublicApi {}
+
+@App({
+  name: 'admin-api',
+  auth: {
+    mode: 'remote',
+    provider: 'https://auth.example.com',
+    clientId: process.env['ADMIN_OAUTH_CLIENT_ID'] ?? 'admin-client',
+  },
+  tools: [AdminConfigTool],
+})
+class AdminApi {}
+
+@FrontMcp({
+  info: { name: 'multi-app-server', version: '1.0.0' },
+  apps: [PublicApi, AdminApi],
+})
+class Server {}
+```
+
+## What This Demonstrates
+
+- Hosting multiple `@App` instances on a single FrontMCP server with different auth modes
+- Using `public` mode for open-access endpoints alongside `remote` mode for admin-only endpoints
+- Isolating tools per app so each security posture governs only its own tools
+
+## Related
+
+- See `configure-auth` for individual auth mode configuration details
+- See `configure-auth-modes` for a feature comparison table across all modes

package/catalog/frontmcp-config/examples/configure-auth/public-mode-setup.md

@@ -0,0 +1,63 @@
+---
+name: public-mode-setup
+reference: configure-auth
+level: basic
+description: 'Set up a FrontMCP server with public (unauthenticated) access and anonymous scopes.'
+tags: [config, auth, session, public, mode, setup]
+features:
+  - "Configuring `mode: 'public'` for unauthenticated access"
+  - 'Setting `sessionTtl` to control anonymous session lifetime'
+  - 'Granting `anonymousScopes` so tools can check scope-based permissions even without auth'
+---
+
+# Public Auth Mode Setup
+
+Set up a FrontMCP server with public (unauthenticated) access and anonymous scopes.
+
+## Code
+
+```typescript
+// src/server.ts
+import { FrontMcp, App, Tool, ToolContext } from '@frontmcp/sdk';
+import { z } from 'zod';
+
+@Tool({
+  name: 'search',
+  description: 'Search public records',
+  inputSchema: { query: z.string() },
+  outputSchema: { results: z.array(z.string()) },
+})
+class SearchTool extends ToolContext {
+  async execute(input: { query: string }) {
+    return { results: [`Result for: ${input.query}`] };
+  }
+}
+
+@App({
+  name: 'public-api',
+  auth: {
+    mode: 'public',
+    sessionTtl: 3600,
+    anonymousScopes: ['read'],
+  },
+  tools: [SearchTool],
+})
+class PublicApi {}
+
+@FrontMcp({
+  info: { name: 'my-server', version: '1.0.0' },
+  apps: [PublicApi],
+})
+class Server {}
+```
+
+## What This Demonstrates
+
+- Configuring `mode: 'public'` for unauthenticated access
+- Setting `sessionTtl` to control anonymous session lifetime
+- Granting `anonymousScopes` so tools can check scope-based permissions even without auth
+
+## Related
+
+- See `configure-auth` for all four auth modes
+- See `configure-auth-modes` for a detailed comparison of modes

package/catalog/frontmcp-config/examples/configure-auth/remote-oauth-with-vault.md

@@ -0,0 +1,76 @@
+---
+name: remote-oauth-with-vault
+reference: configure-auth
+level: intermediate
+description: 'Configure a FrontMCP server with remote OAuth 2.1 authentication and use the credential vault to call downstream APIs on behalf of the authenticated user.'
+tags: [config, oauth, auth, remote, vault]
+features:
+  - "Configuring `mode: 'remote'` for full OAuth 2.1 authorization flow"
+  - 'Loading `clientId` from environment variables instead of hardcoding'
+  - "Using `this.authProviders.headers('github')` to get pre-formatted auth headers for downstream API calls"
+---
+
+# Remote OAuth Mode with Credential Vault
+
+Configure a FrontMCP server with remote OAuth 2.1 authentication and use the credential vault to call downstream APIs on behalf of the authenticated user.
+
+## Code
+
+```typescript
+// src/server.ts
+import { FrontMcp, App, Tool, ToolContext } from '@frontmcp/sdk';
+import { z } from 'zod';
+
+@Tool({
+  name: 'create_github_issue',
+  description: 'Create a GitHub issue on behalf of the user',
+  inputSchema: {
+    repo: z.string(),
+    title: z.string(),
+    body: z.string(),
+  },
+  outputSchema: { issueUrl: z.string() },
+})
+class CreateGithubIssueTool extends ToolContext {
+  async execute(input: { repo: string; title: string; body: string }) {
+    // Access downstream credentials via the authProviders context extension
+    const headers = await this.authProviders.headers('github');
+
+    const response = await fetch(`https://api.github.com/repos/${input.repo}/issues`, {
+      method: 'POST',
+      headers: { ...headers, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ title: input.title, body: input.body }),
+    });
+    const issue = await response.json();
+    return { issueUrl: issue.html_url };
+  }
+}
+
+@App({
+  name: 'dev-tools',
+  auth: {
+    mode: 'remote',
+    provider: 'https://auth.example.com',
+    clientId: process.env['OAUTH_CLIENT_ID'] ?? 'mcp-client-id',
+  },
+  tools: [CreateGithubIssueTool],
+})
+class DevToolsApp {}
+
+@FrontMcp({
+  info: { name: 'dev-tools-server', version: '1.0.0' },
+  apps: [DevToolsApp],
+})
+class Server {}
+```
+
+## What This Demonstrates
+
+- Configuring `mode: 'remote'` for full OAuth 2.1 authorization flow
+- Loading `clientId` from environment variables instead of hardcoding
+- Using `this.authProviders.headers('github')` to get pre-formatted auth headers for downstream API calls
+
+## Related
+
+- See `configure-auth` for credential vault API (`get`, `headers`, `has`, `refresh`)
+- See `configure-session` for setting up Redis-based session storage in production

package/catalog/frontmcp-config/examples/configure-auth-modes/local-self-signed-tokens.md

@@ -0,0 +1,77 @@
+---
+name: local-self-signed-tokens
+reference: configure-auth-modes
+level: intermediate
+description: 'Configure a server that signs its own JWT tokens with consent and incremental auth enabled.'
+tags: [config, auth, redis, local, auth-modes, modes]
+features:
+  - "Using `mode: 'local'` so the server signs its own JWTs"
+  - 'Setting `local.issuer` and `local.audience` to control token claims'
+  - 'Enabling `consent` for explicit user authorization flow'
+  - 'Enabling `incrementalAuth` to request additional scopes progressively'
+  - 'Using Redis for token storage in production'
+---
+
+# Local Self-Signed Tokens
+
+Configure a server that signs its own JWT tokens with consent and incremental auth enabled.
+
+## Code
+
+```typescript
+// src/server.ts
+import { FrontMcp, App, Tool, ToolContext } from '@frontmcp/sdk';
+import { z } from 'zod';
+
+@Tool({
+  name: 'manage_users',
+  description: 'Manage user accounts',
+  inputSchema: { action: z.enum(['list', 'create', 'delete']), userId: z.string().optional() },
+  outputSchema: { success: z.boolean(), message: z.string() },
+})
+class ManageUsersTool extends ToolContext {
+  async execute(input: { action: string; userId?: string }) {
+    return { success: true, message: `Action ${input.action} completed` };
+  }
+}
+
+@App({
+  name: 'internal-api',
+  auth: {
+    mode: 'local',
+    local: {
+      issuer: 'my-internal-server',
+      audience: 'internal-api',
+    },
+    tokenStorage: 'redis',
+    consent: { enabled: true },
+    incrementalAuth: { enabled: true },
+  },
+  tools: [ManageUsersTool],
+})
+class InternalApi {}
+
+@FrontMcp({
+  info: { name: 'local-auth-server', version: '1.0.0' },
+  apps: [InternalApi],
+  redis: {
+    provider: 'redis',
+    host: process.env['REDIS_HOST'] ?? 'localhost',
+    port: 6379,
+  },
+})
+class Server {}
+```
+
+## What This Demonstrates
+
+- Using `mode: 'local'` so the server signs its own JWTs
+- Setting `local.issuer` and `local.audience` to control token claims
+- Enabling `consent` for explicit user authorization flow
+- Enabling `incrementalAuth` to request additional scopes progressively
+- Using Redis for token storage in production
+
+## Related
+
+- See `configure-auth-modes` for a comparison of all auth modes
+- See `configure-session` for session storage configuration

package/catalog/frontmcp-config/examples/configure-auth-modes/remote-enterprise-oauth.md

@@ -0,0 +1,73 @@
+---
+name: remote-enterprise-oauth
+reference: configure-auth-modes
+level: advanced
+description: 'Delegate authentication to an external OAuth orchestrator with Redis-backed token storage.'
+tags: [config, oauth, auth, redis, remote, auth-modes]
+features:
+  - "Using `mode: 'remote'` to delegate to an external OAuth 2.1 authorization server"
+  - 'Loading `clientId` and `clientSecret` from environment variables (never hardcoded)'
+  - 'Configuring Redis-backed token storage for production persistence'
+  - 'Full OAuth flow: clients are redirected to the provider and return with an authorization code'
+---
+
+# Remote Enterprise OAuth
+
+Delegate authentication to an external OAuth orchestrator with Redis-backed token storage.
+
+## Code
+
+```typescript
+// src/server.ts
+import { FrontMcp, App, Tool, ToolContext } from '@frontmcp/sdk';
+import { z } from 'zod';
+
+@Tool({
+  name: 'query_data',
+  description: 'Query enterprise data warehouse',
+  inputSchema: { sql: z.string() },
+  outputSchema: { rows: z.array(z.record(z.string(), z.unknown())), rowCount: z.number() },
+})
+class QueryDataTool extends ToolContext {
+  async execute(input: { sql: string }) {
+    return { rows: [{ id: 1, name: 'example' }], rowCount: 1 };
+  }
+}
+
+@App({
+  name: 'enterprise-api',
+  auth: {
+    mode: 'remote',
+    provider: 'https://auth.example.com',
+    clientId: process.env['OAUTH_CLIENT_ID']!,
+    clientSecret: process.env['OAUTH_CLIENT_SECRET'],
+    tokenStorage: 'redis',
+  },
+  tools: [QueryDataTool],
+})
+class EnterpriseApi {}
+
+@FrontMcp({
+  info: { name: 'enterprise-server', version: '1.0.0' },
+  apps: [EnterpriseApi],
+  redis: {
+    provider: 'redis',
+    host: process.env['REDIS_HOST'] ?? 'redis.internal',
+    port: Number(process.env['REDIS_PORT'] ?? 6379),
+    password: process.env['REDIS_PASSWORD'],
+  },
+})
+class Server {}
+```
+
+## What This Demonstrates
+
+- Using `mode: 'remote'` to delegate to an external OAuth 2.1 authorization server
+- Loading `clientId` and `clientSecret` from environment variables (never hardcoded)
+- Configuring Redis-backed token storage for production persistence
+- Full OAuth flow: clients are redirected to the provider and return with an authorization code
+
+## Related
+
+- See `configure-auth-modes` for a comparison of all auth modes
+- See `setup-redis` for Redis provisioning details

package/catalog/frontmcp-config/examples/configure-auth-modes/transparent-jwt-validation.md

@@ -0,0 +1,64 @@
+---
+name: transparent-jwt-validation
+reference: configure-auth-modes
+level: basic
+description: 'Validate externally-issued JWTs without managing token lifecycle on the server.'
+tags: [config, auth, transparent, auth-modes, modes, jwt]
+features:
+  - "Using `mode: 'transparent'` to validate tokens from an external identity provider"
+  - 'Setting `expectedAudience` to restrict which tokens are accepted'
+  - 'The server fetches JWKS from `{provider}/.well-known/jwks.json` automatically'
+---
+
+# Transparent JWT Validation
+
+Validate externally-issued JWTs without managing token lifecycle on the server.
+
+## Code
+
+```typescript
+// src/server.ts
+import { FrontMcp, App, Tool, ToolContext } from '@frontmcp/sdk';
+import { z } from 'zod';
+
+@Tool({
+  name: 'get_profile',
+  description: 'Get the authenticated user profile',
+  inputSchema: { userId: z.string() },
+  outputSchema: { id: z.string(), email: z.string() },
+})
+class GetProfileTool extends ToolContext {
+  async execute(input: { userId: string }) {
+    return { id: input.userId, email: `${input.userId}@example.com` };
+  }
+}
+
+@App({
+  name: 'api',
+  auth: {
+    mode: 'transparent',
+    provider: 'https://auth.example.com',
+    expectedAudience: 'my-api',
+    clientId: 'my-client-id',
+  },
+  tools: [GetProfileTool],
+})
+class ApiApp {}
+
+@FrontMcp({
+  info: { name: 'transparent-server', version: '1.0.0' },
+  apps: [ApiApp],
+})
+class Server {}
+```
+
+## What This Demonstrates
+
+- Using `mode: 'transparent'` to validate tokens from an external identity provider
+- Setting `expectedAudience` to restrict which tokens are accepted
+- The server fetches JWKS from `{provider}/.well-known/jwks.json` automatically
+
+## Related
+
+- See `configure-auth-modes` for a comparison of all auth modes
+- See `configure-auth` for the full authentication setup guide