$npx -y skills add maton-ai/api-gateway-skill --skill api-gatewayConnect to external services through Maton-managed API routes. Use this skill only after the user names the target app, account, and task. Start with read/list calls when possible and follow the app-specific reference before any change.
| 1 | # API Gateway |
| 2 | |
| 3 | Managed API routing for third-party services, provided by [Maton](https://maton.ai). Use this only for a user-requested app, account, and task. |
| 4 | |
| 5 | ## Quick Start |
| 6 | |
| 7 | **CLI:** |
| 8 | |
| 9 | ```bash |
| 10 | maton slack channel list --types public_channel --limit 10 |
| 11 | ``` |
| 12 | |
| 13 | ```bash |
| 14 | maton api '/slack/api/conversations.list?types=public_channel&limit=10' |
| 15 | ``` |
| 16 | |
| 17 | **Python:** |
| 18 | |
| 19 | ```bash |
| 20 | python <<'EOF' |
| 21 | import urllib.request, os, json |
| 22 | req = urllib.request.Request('https://api.maton.ai/slack/api/conversations.list?types=public_channel&limit=10') |
| 23 | req.add_header('Authorization', f'Bearer {os.environ["MATON_API_KEY"]}') |
| 24 | print(json.dumps(json.load(urllib.request.urlopen(req)), indent=2)) |
| 25 | EOF |
| 26 | ``` |
| 27 | |
| 28 | ## Routing |
| 29 | |
| 30 | Use `https://api.maton.ai/` with the app-prefixed routes documented in the examples below or in the matching reference file. |
| 31 | |
| 32 | **Usage protocol:** |
| 33 | 1. Only invoke after the user specifies the exact app, account, and task. |
| 34 | 2. Always start with read-only (GET) calls to verify the target account, resource identifiers, and current state. |
| 35 | 3. **All non-GET requests are denied unless the user explicitly approves each one.** Before any POST, PUT, PATCH, or DELETE call, present the user with: the exact connection ID, the full endpoint path, the request body, and the expected outcome — then wait for approval. |
| 36 | 4. If the user's request implies a non-GET operation, first show them what you intend to call and ask for confirmation. Do not infer approval from the original request. |
| 37 | |
| 38 | Read-only route examples: |
| 39 | |
| 40 | ```text |
| 41 | https://api.maton.ai/slack/api/conversations.list?types=public_channel&limit=10 |
| 42 | https://api.maton.ai/google-mail/gmail/v1/users/me/messages |
| 43 | ``` |
| 44 | |
| 45 | The first path segment is the app identifier listed in Supported Services. For Gmail, use `/google-mail/gmail/v1/users/me/messages`. |
| 46 | |
| 47 | ## Installation |
| 48 | |
| 49 | **NPM:** |
| 50 | ```bash |
| 51 | npm install -g @maton/cli |
| 52 | ``` |
| 53 | |
| 54 | **Homebrew:** |
| 55 | ```bash |
| 56 | brew install maton-ai/cli/maton |
| 57 | ``` |
| 58 | |
| 59 | ## Authentication |
| 60 | |
| 61 | **IMPORTANT — Credential Safety:** |
| 62 | - Treat `MATON_API_KEY` as a secret. Never log it, echo it, paste it into prompts, or expose it in shared files, command output, or tool results. |
| 63 | - **Connection creation requires explicit user approval.** Before creating any connection, ask the user to confirm the specific service and confirm they intend to authorize access. Never create connections on the agent's own initiative. |
| 64 | - **Least-privilege scopes:** When a service offers scope selection during OAuth, select only the scopes the current task requires. Do not accept broader scopes for convenience. |
| 65 | - Remove connections immediately after the task is complete if they are no longer needed (`maton connection delete {id}`). |
| 66 | - If the key may have been exposed (logs, screenshots, shared terminals), rotate it immediately at [maton.ai/settings](https://maton.ai/settings). |
| 67 | - Never share the key across users, workflows, or environments that do not require it. |
| 68 | |
| 69 | **CLI:** |
| 70 | |
| 71 | ```bash |
| 72 | maton login # Opens browser for API key |
| 73 | maton login --interactive # Skip browser, paste API key directly |
| 74 | maton whoami # Show current auth state |
| 75 | ``` |
| 76 | |
| 77 | **Manual:** |
| 78 | |
| 79 | 1. Sign in or create an account at [maton.ai](https://maton.ai) |
| 80 | 2. Go to [maton.ai/settings](https://maton.ai/settings) |
| 81 | 3. Click the copy button on the right side of API Key section to copy it |
| 82 | 4. Set your API key as `MATON_API_KEY`: |
| 83 | |
| 84 | ```bash |
| 85 | export MATON_API_KEY="YOUR_API_KEY" |
| 86 | ``` |
| 87 | |
| 88 | ## Connection Management |
| 89 | |
| 90 | ### List Connections |
| 91 | |
| 92 | **CLI:** |
| 93 | |
| 94 | ```bash |
| 95 | maton connection list slack --status ACTIVE |
| 96 | ``` |
| 97 | |
| 98 | ```bash |
| 99 | maton api -X GET /connections -f app=slack -f status=ACTIVE |
| 100 | ``` |
| 101 | |
| 102 | **Python:** |
| 103 | |
| 104 | ```bash |
| 105 | python <<'EOF' |
| 106 | import urllib.request, os, json |
| 107 | req = urllib.request.Request('https://api.maton.ai/connections?app=slack&status=ACTIVE') |
| 108 | req.add_header('Authorization', f'Bearer {os.environ["MATON_API_KEY"]}') |
| 109 | print(json.dumps(json.load(urllib.request.urlopen(req)), indent=2)) |
| 110 | EOF |
| 111 | ``` |
| 112 | |
| 113 | **Query Parameters (optional):** |
| 114 | - `app` - Filter by service name (e.g., `slack`, `hubspot`, `salesforce`) |
| 115 | - `status` - Filter by connection status (`ACTIVE`, `PENDING`, `FAILED`) |
| 116 | |
| 117 | **Response:** |
| 118 | ```json |
| 119 | { |
| 120 | "connections": [ |
| 121 | { |
| 122 | "connection_id": "{connection_id}", |
| 123 | "status": "ACTIVE", |
| 124 | "creation_time": "2025-12-08T07:20:53.488460Z", |
| 125 | "last_updated_time": "2026-01-31T20:03:32.593153Z", |
| 126 | "url": "https://connect.maton.ai/?session_token=5e9...", |
| 127 | "app": "slack", |
| 128 | "method": "OAUTH2", |
| 129 | "metadata": {} |
| 130 | } |
| 131 | ] |
| 132 | } |
| 133 | ``` |
| 134 | |
| 135 | ### Create Connection |
| 136 | |
| 137 | **CLI:** |
| 138 | |
| 139 | ```bash |
| 140 | maton connection create slack |
| 141 | ``` |
| 142 | |
| 143 | ```bash |
| 144 | maton api /connect |