openapi-authlisted

# Openapi authentication (OAuth v2) All Openapi services require a Bearer token created through OAuth v2. This skill manages that token lifecycle. ## Credentials Two layers — never confuse them: 1. **Account credentials** (email + API key) → used only against `https://oauth.openapi.com`, as HTTP Basic auth (`username = email`, `password = API key`). 2. **Bearer token** (created here, with scopes) → used against every service API as `Authorization: Bearer <token>`. Expect credentials in the environment as `OPENAPI_EMAIL`, `OPENAPI_API_KEY` (and optionally a ready-made `OPENAPI_TOKEN`). Never print or commit them. ## Create a token ```bash curl -s -u "$OPENAPI_EMAIL:$OPENAPI_API_KEY" https://oauth.openapi.com/tokens \ -H 'Content-Type: application/json' \ -d '{ "scopes": ["GET:company.openapi.com/IT-start"], "name": "agent token", "ttl": 86400 }' ``` - Scope format: `METHOD:host/path-prefix` (e.g. `POST:sms.openapi.com/IT-messages`). Request only the scopes the task needs, with a short `ttl` (max 1 year). - Discover valid scopes: `GET https://oauth.openapi.com/scopes` (Basic auth). - Optional `limits` object restricts token usage further. - A refresh token can renew a token: `PATCH /tokens/{id}` with the refresh token as Bearer. - Tokens can also be created from the console UI (Authentication → "+New Token") at https://console.openapi.com. ## Management endpoints (Basic auth) | Endpoint | Purpose | |---|---| | `GET /tokens`, `GET\|PATCH\|DELETE /toke