agent-keys
starsforks
How to install agent-keys?
shurikentrade/shuriken-skills/agent-keys
$npx -y skills add ShurikenTrade/shuriken-skills --skill agent-keysUse when a user asks how to authenticate as an agent, create or rotate API credentials, or understand the lifecycle of agent keys on Shuriken.
SKILL.md
| 1 | # Using agent keys |
| 2 | |
| 3 | Agent keys are Shuriken's credential primitive for programmatic access. They authenticate a caller, carry a set of scopes defining what the caller can do, and are revocable without affecting the owning user's session. |
| 4 | |
| 5 | ## Approach |
| 6 | |
| 7 | 1. **One key per integration, not per user action.** An agent key represents a long-lived integration. Do not create a key per request. |
| 8 | 2. **Grant the minimum scope.** See `shuriken:scoping` for how scopes are structured and how to reason about least-privilege. |
| 9 | 3. **Treat keys as secrets.** Store them in environment variables or secret managers. Never hard-code. Never log. Never commit. |
| 10 | |
| 11 | ## Key lifecycle |
| 12 | |
| 13 | - **Create** at [app.shuriken.trade/agents](https://app.shuriken.trade/agents) (the authenticated user's agent-key management page), or via the agent-key management API once bootstrapped. The key is displayed once at creation — capture it immediately. |
| 14 | - **Use** the same agent key across every surface: |
| 15 | - REST — pass the key in the `Authorization: Bearer <key>` header on every request. |
| 16 | - WebSocket — authenticate the connection with the same agent key (subject to the key's scopes, just like REST). The streaming endpoints share the same credential model; there is no separate websocket token. |
| 17 | - SDKs — both the TypeScript and Rust SDKs accept the agent key directly in the client constructor. Prefer the SDK path when the user's language is supported; it handles header/connection wiring for you. |
| 18 | - **Rotate** periodically and after any suspected compromise. Rotation means: create the new key, deploy it to the consuming service, then revoke the old key. Not the reverse. |
| 19 | - **Revoke** when an integration is retired, a contractor departs, or the key is exposed. Revocation is immediate. |
| 20 | |
| 21 | ## One user, one integration |
| 22 | |
| 23 | An agent key belongs to a single Shuriken user. An integration holds that user's key (or the few keys that user has created for different purposes). There is no multi-tenant flow where an app mints keys on behalf of many users — every key is owned by the Shuriken account that created it. |
| 24 | |
| 25 | ## Pointers |
| 26 | |
| 27 | - Platform documentation (including key management): fetch `https://docs.shuriken.trade/llms.txt` and search for "agent keys" |
| 28 | - OpenAPI paths: `/v1/agent-keys/*` — fetch `https://docs.shuriken.trade/api-reference/openapi.json` for current signatures |
| 29 | - Related skills: `shuriken:scoping`, `shuriken:api-integration` |
People who liked this also viewed
6 picksType
- find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 2026
- grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026
- vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026
- improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026
- setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026
- triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026
