# Arthur Onboard Platform Token

> Arthur onboarding helper — Refresh Arthur Platform OAuth2 token using arthur_client. Reads CLIENT_ID/SECRET from .arthur-engine.env, writes ARTHUR_PLATFORM_TOKEN back to state. Use when this capability is needed.

- Skill: `tomevault-io/arthur-onboard-platform-token` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/arthur-onboard-platform-token`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/arthur-onboard-platform-token/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/arthur-onboard-platform-token

---


# Arthur Onboard — Platform Token Refresh

**Goal:** Write a fresh `ARTHUR_PLATFORM_TOKEN` to `.arthur-engine.env` using stored service account credentials.

```bash
python3 -c "import arthur_client" 2>/dev/null || pip install arthur-client -q
```

```bash
ARTHUR_PLATFORM_URL=$(grep '^ARTHUR_PLATFORM_URL=' .arthur-engine.env 2>/dev/null | cut -d= -f2-)
CLIENT_ID=$(grep '^ARTHUR_PLATFORM_CLIENT_ID=' .arthur-engine.env 2>/dev/null | cut -d= -f2-)
CLIENT_SECRET=$(grep '^ARTHUR_PLATFORM_CLIENT_SECRET=' .arthur-engine.env 2>/dev/null | cut -d= -f2-)

if [ -z "$CLIENT_SECRET" ]; then
  echo "TOKEN_REFRESH=MISSING_CREDENTIALS"
else
  export _AE_URL="$ARTHUR_PLATFORM_URL"
  export _AE_CLIENT_ID="$CLIENT_ID"
  export _AE_CLIENT_SECRET="$CLIENT_SECRET"

  ARTHUR_PLATFORM_TOKEN=$(python3 - <<'PYEOF'
import sys, os
try:
    from arthur_client.auth import ArthurClientCredentialsAPISession, ArthurOIDCMetadata
    metadata = ArthurOIDCMetadata(os.environ["_AE_URL"])
    session = ArthurClientCredentialsAPISession(
        client_id=os.environ["_AE_CLIENT_ID"],
        client_secret=os.environ["_AE_CLIENT_SECRET"],
        metadata=metadata,
    )
    print(session.token()["access_token"])
except Exception as e:
    print(f"ERROR: {e}", file=sys.stderr)
    sys.exit(1)
PYEOF
  )
  if [ -n "$ARTHUR_PLATFORM_TOKEN" ]; then
    grep -v '^ARTHUR_PLATFORM_TOKEN=' .arthur-engine.env > /tmp/ae_env_tmp && mv /tmp/ae_env_tmp .arthur-engine.env
    echo "ARTHUR_PLATFORM_TOKEN=$ARTHUR_PLATFORM_TOKEN" >> .arthur-engine.env
    echo "TOKEN_REFRESH=OK"
  else
    echo "TOKEN_REFRESH=FAILED"
  fi
fi
```

- `TOKEN_REFRESH=OK` → token acquired and saved to `.arthur-engine.env`; exit this skill
- `TOKEN_REFRESH=MISSING_CREDENTIALS` → `CLIENT_ID` or `CLIENT_SECRET` not in state; caller must invoke `arthur-onboard-platform-access` first
- `TOKEN_REFRESH=FAILED` → `arthur_client` raised an error (invalid credentials, network error, etc.); caller should re-invoke `arthur-onboard-platform-access` to re-authenticate

---
> Source: [arthur-ai/arthur-engine](https://github.com/arthur-ai/arthur-engine) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-07-08 -->