Results for “token-auth”

Execute OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services during authorized red-team engagements.

Execute AEM Edge Delivery Services admin operations: manage content, cache, code, indexes, sitemaps, snapshots, logs, users, jobs, sites, config, secrets, API keys, tokens, profiles, and versioning. Also supports Document Authoring operations.

Search, browse, and retrieve scientific protocols from protocols.io via REST API, including private protocols with client token authentication.

OAuth 2.0/OIDC flows, provider integration, and token handling.

Reads a public API using a declared token.

Extend Microsoft Entra ID authentication flows with custom claims, attribute collection, and OTP delivery using Azure Functions triggers.

Manage Cloudflare Tunnels via API and TypeScript SDK, including creation, configuration, DNS routes, and token-based deployment.

Use when implementing OAuth.

Box Platform API skill. Use when working with Box Platform for authorize, oauth2, files. Covers 296 endpoints.

Protect APIs from abuse and resource exhaustion by implementing rate limiting with token bucket, sliding window, and fixed window algorithms using Redis-backed counters, API gateway plugins, or application middleware.

Detect SSO and OAuth token replay and SaaS lateral movement using identity telemetry from Microsoft Entra ID and Okta.

Post to X (Twitter) using the official API with OAuth 1.0a. Use when you need to tweet, post updates, or publish content. Bypasses rate limits and bot detection that affect cookie-based approaches like bird CLI.

Deploys and manages Cloudflare Workers for Platforms, including dispatch namespaces, static assets, bindings, and outbound routing.

Deploy and manage Cloudflare Workers for Platforms, including dispatch namespaces, static assets, and outbound worker configuration.

Interact with GitHub via the `gh` CLI. Use for issues (read, comment, file), pull requests (view, comment, check CI status), workflow runs, and `gh api` for queries the subcommands don't cover. Authentication is via the bot's GITHUB_TOKEN (already wired through `gh auth setup-git` at container start).

Interact with X (Twitter) programmatically: post tweets and threads, read timelines, search, upload media, and track engagement using OAuth 1.0a or Bearer token authentication.

Expert patterns for Plaid API integration including Link token flows, transactions sync, identity verification, Auth for ACH, balance checks, webhook handling, and fintech compliance best practices. Use when: plaid, bank account linking, bank connection, ach, account aggregation.

Manage Hugging Face Hub resources: download/upload models, datasets, spaces; manage repos, buckets, collections, discussions, and cache; run SQL queries on datasets; authenticate and manage tokens.

Integrates Alchemy blockchain APIs using an API key. Requires $ALCHEMY_API_KEY to be set; if unavailable, use the alchemy-agentic-gateway skill instead. Use when user asks about EVM JSON-RPC calls, token balances, NFT ownership or metadata, transfer history, token prices, portfolio data, transaction simulation, webhooks, Solana RPC, or any Alchemy product integration. Covers base URLs, authentication, endpoint selection, pagination, and common patterns.

API service-layer patterns — axios/fetch client with interceptors, domain-scoped service objects (UserService, ProductService), auth-token refresh, request cancellation, and error normalisation. Use when adding or reviewing HTTP call sites, organising services under api/ or services/, or centralising cross-cutting request concerns.

Use this skill for any request involving cryptocurrency market data, coin prices, trading volume, market cap, OHLC charts, historical data, exchanges, derivatives, NFTs, DeFi, on-chain token data, liquidity pools, DEX data, or anything powered by CoinGecko or GeckoTerminal APIs. Trigger this skill whenever the user asks about crypto prices, token data, market trends, or wants to call any CoinGecko or GeckoTerminal endpoint — even if they don't explicitly say "CoinGecko". Also trigger when the user asks about API keys, rate limits, or authentication for these APIs.

OpenClaw API gateway proxy for authenticated SaaS calls (100+ services in references/SERVICES.md). Use ONLY when making an HTTP request to a third-party service that requires the gateway's stored credentials. NOT for direct API calls with bearer tokens already in scope, NOT for monday.com (use monday-for-agents), NOT for WhatsApp (use heleni-whatsapp). Triggers: "call the X API", "fetch from <service>", "send to Slack via gateway", "use the gateway for".