---
title: "tRPC - Auth - Air Market"
description: "Your tRPC app needs to know who is making each call, and some calls should be off limits to anyone not signed in. This helps you pull the user out of a token or cookie on the server and turn away cal…"
canonical: "https://airmarket.ai/app/auth"
---

[Air Market](/) / [Developer Tools](/category/devtools) / tRPC - Auth

Skill by [tRPC](/@trpc)

# tRPC - Auth

Know who is calling your tRPC API and keep strangers out

## What this does

Your tRPC app needs to know who is making each call, and some calls should be off limits to anyone not signed in. This helps you pull the user out of a token or cookie on the server and turn away calls that have no user. It also helps the client send its credentials, including over live connections.

### Top 3 things it does for you

- Read the signed-in user from a token or cookie
- Lock procedures so only signed-in users can call them
- Send login credentials from the client with every request

## Information

**tRPC - Auth at a glance**

|  |  |
| --- | --- |
| Kind | Skill |
| Publisher | [tRPC](/@trpc) |
| Category | [Developer Tools](/category/devtools) |
| Works with | Agent Skills - an open standard supported by 40+ agents |
| Size | 8 KB |
| Licence | MIT |
| Repository | [trpc/trpc](https://github.com/trpc/trpc/tree/23c723cfeaf07da28a52a5c35c3dcccf96a47578/packages/server/skills/auth) |
| GitHub stars | 40,541 (as of Nov 2026) |

## Security report

**Verified.** AIR scanned this exact version of tRPC - Auth and flagged nothing. AIR's verdict: **safe**.

**What tRPC - Auth's check was run against**

|  |  |
| --- | --- |
| Commit | 23c723cfeaf07da28a52a5c35c3dcccf96a47578 |
| Content hash | 1a8fe1e1f605d769b7b8fb9f2938c693cded131841a6ae79ffc7353763945a45 |
| Files read | [Browse the files at this exact commit](https://github.com/trpc/trpc/blob/23c723cfeaf07da28a52a5c35c3dcccf96a47578/packages/server/skills/auth/SKILL.md) |

A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned.

[Read the full security report for tRPC - Auth](/security/auth)

## About tRPC - Auth

This covers authentication and authorization in tRPC using JWTs or cookies. The user is extracted in createContext, and a middleware built with t.middleware and opts.next({ ctx }) narrows the context so the user is known to be non-null.

From there it sets up a protectedProcedure base that other procedures build on. On the client side it covers sending Authorization headers through the headers() option of httpBatchLink, passing credentials over WebSocket with connectionParams, and handling SSE auth through cookies or custom headers with an EventSource polyfill.

## What's inside

- SKILL.md - instructions

## Questions

### Is tRPC - Auth safe to install?

AIR scanned this exact version of tRPC - Auth and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit 23c723cfeaf0, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/auth.

### How do I install tRPC - Auth?

Open https://airmarket.ai/app/auth on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/trpc/trpc/tree/23c723cfeaf07da28a52a5c35c3dcccf96a47578/packages/server/skills/auth. Install from that link, not the branch.

## Related on Air Market

- [More Developer Tools listings](/category/devtools)
- [Everything by tRPC](/@trpc)

---

Canonical URL: <https://airmarket.ai/app/auth>