---
title: "Auth Server Primitives - Air Market"
description: "Logging people in has a server half: the cookie that remembers them, the handshake with an outside sign-in provider, and the small holes attackers poke at. This covers those pieces for TanStack Start…"
canonical: "https://airmarket.ai/app/auth-server-primitives"
---

[Air Market](/) / [Developer Tools](/category/devtools) / Auth Server Primitives

Skill by [TanStack](/@tanstack)

# Auth Server Primitives

Build the server side of signing in, cookie by cookie

## What this does

Logging people in has a server half: the cookie that remembers them, the handshake with an outside sign-in provider, and the small holes attackers poke at. This covers those pieces for TanStack Start, from setting and clearing sessions to protecting reset and non-GET requests. Reach for it when you are writing the login machinery rather than the pages around it.

### Top 3 things it does for you

- Issue, read and destroy a session cookie
- Add a sign-in-with-provider flow
- Stop a password reset form from leaking which emails exist

## Information

**Auth Server Primitives at a glance**

|  |  |
| --- | --- |
| Kind | Skill |
| Publisher | [TanStack](/@tanstack) |
| Category | [Developer Tools](/category/devtools) |
| Works with | Agent Skills - an open standard supported by 40+ agents |
| Size | 17 KB |
| Licence | MIT |
| Repository | [TanStack/router](https://github.com/TanStack/router/tree/179d9b9b5eec50dc7833b4e2ef91b735d34bbc07/packages/start-client-core/skills/start-core/auth-server-primitives) |
| GitHub stars | 14,984 (as of Nov 2026) |

## Security report

**Verified.** AIR scanned this exact version of Auth Server Primitives and flagged nothing. AIR's verdict: **safe**.

**What Auth Server Primitives's check was run against**

|  |  |
| --- | --- |
| Commit | 179d9b9b5eec50dc7833b4e2ef91b735d34bbc07 |
| Content hash | e2e0ae1a94d6025a6f9014fa26e86f0c686e39fa029665a42d06bf4dae9d57cb |
| Files read | [Browse the files at this exact commit](https://github.com/TanStack/router/blob/179d9b9b5eec50dc7833b4e2ef91b735d34bbc07/packages/start-client-core/skills/start-core/auth-server-primitives/SKILL.md) |

A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned.

[Read the full security report for Auth Server Primitives](/security/auth-server-primitives)

## About Auth Server Primitives

Server-side authentication primitives for TanStack Start: session cookies with HttpOnly, Secure, SameSite and the __Host- prefix, and reading, issuing and destroying those sessions through createServerFn and middleware.

Covers the OAuth authorization-code flow with state and PKCE, password-reset enumeration defense, CSRF for non-GET RPCs, rate limiting on auth endpoints, and rotating the session when privileges change.

It handles the server half only. It pairs with router-core/auth-and-guards, which covers the routing side.

## What's inside

- SKILL.md - instructions

## Questions

### Is Auth Server Primitives safe to install?

AIR scanned this exact version of Auth Server Primitives and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit 179d9b9b5eec, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/auth-server-primitives.

### How do I install Auth Server Primitives?

Open https://airmarket.ai/app/auth-server-primitives on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/TanStack/router/tree/179d9b9b5eec50dc7833b4e2ef91b735d34bbc07/packages/start-client-core/skills/start-core/auth-server-primitives. Install from that link, not the branch.

## Related on Air Market

- [More Developer Tools listings](/category/devtools)
- [Everything by TanStack](/@tanstack)

---

Canonical URL: <https://airmarket.ai/app/auth-server-primitives>