> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flexslot.gg/llms.txt
> Use this file to discover all available pages before exploring further.

# Claude Code Skill

> Install the Flexslot OAuth skill so Claude Code can build your integration for you

If you use [Claude Code](https://claude.com/claude-code), you can install a Flexslot OAuth skill that teaches it to build a correct integration — the full authorization-code + PKCE flow, token refresh with rotation, scope handling, DPoP, and calling the game-scoped API — without you copy-pasting from these docs.

The skill encodes everything on this site plus the exact endpoint contracts, so Claude generates working code (correct token lifetimes, game-scoped paths, refresh rotation) instead of guessing.

## Download

<Card title="Download the skill" icon="download" href="https://cdn.flexslot.gg/skills/flexslot-oauth-integration.skill">
  `flexslot-oauth-integration.skill` — a single installable file for Claude Code.
</Card>

## Install

<Steps>
  <Step title="Download the file">
    Grab `flexslot-oauth-integration.skill` from the link above.
  </Step>

  <Step title="Add it to Claude Code">
    Move the file into your Claude Code skills directory:

    ```bash theme={null}
    mkdir -p ~/.claude/skills
    mv ~/Downloads/flexslot-oauth-integration.skill ~/.claude/skills/
    ```

    Claude Code discovers `.skill` files in `~/.claude/skills/` automatically. Restart Claude Code if it's already running.
  </Step>

  <Step title="Verify it loaded">
    Ask Claude Code to list its skills, or just describe your task — the skill activates on its own when you mention a Flexslot OAuth integration.
  </Step>
</Steps>

## Use it

Once installed, prompt Claude Code in plain language. It pulls in the skill when your request matches. Examples:

```text theme={null}
Build a Node/Express app that lets users connect their Flexslot account and list their decks.
```

```text theme={null}
Add "Log in with Flexslot" to my React SPA using a public PKCE client.
```

```text theme={null}
My token refresh keeps returning invalid_grant — help me debug it.
```

The skill walks Claude through PKCE generation, the `state`/`iss` callback checks, the token exchange, refresh-token rotation, scope selection, and the game-scoped API calls. It covers TypeScript/Node, Python, browser SPA, and curl.

<Note>
  The skill is self-contained — it teaches Claude the flow and contracts, but it doesn't ship your credentials. You'll still register a client (Public or Confidential) from **Account → API access** and supply your own `client_id` / `client_secret`. See [Managing OAuth Clients](/oauth/client-management) and the [Quickstart](/oauth/quickstart).
</Note>

## What it covers

* Authorization-code grant with PKCE (S256) — the only user-facing grant
* Token exchange, proactive refresh, and **refresh-token rotation** handling
* Scope selection and incremental authorization
* The **game-scoped** resource API (`/api/public/v1/games/{game}/...`)
* Identifying the connected user via `/_probe/user` for a **"Connected as …"** UI (no extra scope)
* DPoP sender-constrained tokens ([RFC 9449](https://www.rfc-editor.org/rfc/rfc9449))
* Token introspection and revocation
* The full error catalog and a debugging checklist

<Tip>
  Prefer to read rather than delegate? Everything the skill knows is on this site: start with the [Quickstart](/oauth/quickstart) and [Authorization Code Flow](/oauth/authorization-code-flow).
</Tip>