How do I install the Openapi Auth skill?

Run npx skillmds@latest add openapi/openapi-auth in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Openapi Auth safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Openapi Auth?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Openapi Auth free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Openapi Auth?

openapi (@openapi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Openapi Auth by openapi — Agent Skill

Name: Openapi Auth
Author: openapi

Openapi Auth

Authenticate with the Openapi marketplace (oauth.openapi.com). Use when you need to create, inspect, renew or delete Bearer tokens, list available scopes, check wallet credit, subscriptions, or API usage stats. Required by every other openapi-* skill.

openapi 8315a1e 2.9 KB Updated Sep 17, 2026

File contents

Openapi authentication (OAuth v2)

All Openapi services require a Bearer token created through OAuth v2. This skill manages that token lifecycle.

Credentials

Two layers — never confuse them:

Account credentials (email + API key) → used only against https://oauth.openapi.com, as HTTP Basic auth (username = email, password = API key).
Bearer token (created here, with scopes) → used against every service API as Authorization: Bearer <token>.

Expect credentials in the environment as OPENAPI_EMAIL, OPENAPI_API_KEY (and optionally a ready-made OPENAPI_TOKEN). Never print or commit them.

Create a token

curl -s -u "$OPENAPI_EMAIL:$OPENAPI_API_KEY" https://oauth.openapi.com/tokens \
  -H 'Content-Type: application/json' \
  -d '{
    "scopes": ["GET:company.openapi.com/IT-start"],
    "name": "agent token",
    "ttl": 86400
  }'

Scope format: METHOD:host/path-prefix (e.g. POST:sms.openapi.com/IT-messages). Request only the scopes the task needs, with a short ttl (max 1 year).
Discover valid scopes: GET https://oauth.openapi.com/scopes (Basic auth).
Optional limits object restricts token usage further.
A refresh token can renew a token: PATCH /tokens/{id} with the refresh token as Bearer.
Tokens can also be created from the console UI (Authentication → "+New Token") at https://console.openapi.com.

Management endpoints (Basic auth)

Endpoint	Purpose
`GET /tokens`, `GET\|PATCH\|DELETE /tokens/{token}`	Token lifecycle
`GET /scopes`, `GET /scopes/{id}`	Available scopes
`GET /wallet`, `GET /wallet/transactions`	Credit balance — check before expensive paid calls
`GET /subscriptions`, `GET /subscriptions/{id}`	Active plans and remaining requests
`GET /stats`, `GET /stats/apis`, `GET /stats/apis/{domain}`, `GET /stats/ips`	Usage analytics
`GET /errors`, `GET /callbacks`	Error log and callback monitoring

Billing model (affects every service)

Requests are paid from the wallet (per request) or from a subscription (monthly: 30 days no rollover; annual: 365 days, any pace). Both can coexist; the wallet is the fallback when subscription requests run out.
Some APIs have free daily/monthly tiers; rate limits, when present, are stated in each API's description.
Sandbox: free test requests, but "sandbox credit" must be enabled in the console first; responses are illustrative.

Notes

OAuth v1 (oauth.openapi.it) is deprecated — always use oauth.openapi.com.
Service health: https://openapi-com.statuspage.io
Full spec: https://console.openapi.com/oas/en/oauthv2.openapi.json

---name: openapi-authdescription: Authenticate with the Openapi marketplace (oauth.openapi.com). Use when you need to create, inspect, renew or delete Bearer tokens, list available scopes, check wallet credit, subscriptions, or API usage stats. Required by every other openapi-* skill.---# Openapi authentication (OAuth v2)All Openapi services require a Bearer token created through OAuth v2. This skill manages that token lifecycle.## CredentialsTwo layers — never confuse them:1. **Account credentials** (email + API key) → used only against `https://oauth.openapi.com`, as HTTP Basic auth (`username = email`, `password = API key`).2. **Bearer token** (created here, with scopes) → used against every service API as `Authorization: Bearer <token>`.Expect credentials in the environment as `OPENAPI_EMAIL`, `OPENAPI_API_KEY` (and optionally a ready-made `OPENAPI_TOKEN`). Never print or commit them.## Create a token```bashcurl -s -u "$OPENAPI_EMAIL:$OPENAPI_API_KEY" https://oauth.openapi.com/tokens \ -H 'Content-Type: application/json' \ -d '{ "scopes": ["GET:company.openapi.com/IT-start"], "name": "agent token", "ttl": 86400 }'```- Scope format: `METHOD:host/path-prefix` (e.g. `POST:sms.openapi.com/IT-messages`). Request only the scopes the task needs, with a short `ttl` (max 1 year).- Discover valid scopes: `GET https://oauth.openapi.com/scopes` (Basic auth).- Optional `limits` object restricts token usage further.- A refresh token can renew a token: `PATCH /tokens/{id}` with the refresh token as Bearer.- Tokens can also be created from the console UI (Authentication → "+New Token") at https://console.openapi.com.## Management endpoints (Basic auth)| Endpoint | Purpose ||---|---|| `GET /tokens`, `GET\|PATCH\|DELETE /tokens/{token}` | Token lifecycle || `GET /scopes`, `GET /scopes/{id}` | Available scopes || `GET /wallet`, `GET /wallet/transactions` | Credit balance — check before expensive paid calls || `GET /subscriptions`, `GET /subscriptions/{id}` | Active plans and remaining requests || `GET /stats`, `GET /stats/apis`, `GET /stats/apis/{domain}`, `GET /stats/ips` | Usage analytics || `GET /errors`, `GET /callbacks` | Error log and callback monitoring |## Billing model (affects every service)- Requests are paid from the **wallet** (per request) or from a **subscription** (monthly: 30 days no rollover; annual: 365 days, any pace). Both can coexist; the wallet is the fallback when subscription requests run out.- Some APIs have free daily/monthly tiers; rate limits, when present, are stated in each API's description.- **Sandbox**: free test requests, but "sandbox credit" must be enabled in the console first; responses are illustrative.## Notes- OAuth v1 (`oauth.openapi.it`) is deprecated — always use `oauth.openapi.com`.- Service health: https://openapi-com.statuspage.io- Full spec: https://console.openapi.com/oas/en/oauthv2.openapi.json

Frequently asked questions