Skip to content
Skillist
Open app

Authentication

Skillist supports passwordless authentication — no passwords stored.

Sign-in methods

Section titled “Sign-in methods”
Method Where
GitHub OAuth console.skillist.io/login
Google OAuth console.skillist.io/login
Passkey Login page or Account
Magic link Email link via API
Enterprise SSO Login page (when configured)

Account

Section titled “Account”

Signed-in users manage personal auth at console.skillist.io/account:

  • Display name
  • Linked GitHub / Google providers
  • Passkey registration and removal
  • Active session revoke

Org API keys and OAuth app redirect docs stay under Settings.

API auth

Section titled “API auth”

Session cookies are used by the web app. Sign-in happens on console.skillist.io, and production sessions use cross-subdomain cookies on .skillist.io so console.skillist.io, skillist.io, and api.skillist.io all share the same session — signing in on the console is reflected on the marketing site too.

Protected API routes live under /v1/* and require a valid session or org API key.

API keys

Section titled “API keys”

The CLI and any programmatic client authenticate with an org API key, created under Settings in the console and sent as a Bearer token:

Terminal window
export SKILLIST_API_KEY=sk_...

Keys are shown once at creation and stored hashed — if you lose one, revoke it and create another.

Scopes

Section titled “Scopes”

Every key carries an explicit set of scopes, and is refused on any operation outside them.

Scope Grants
skills:read Read skills and registry metadata
skills:write Create skills and upload versions
skills:publish Publish and roll back versions
skills:run Execute skills in the hosted sandbox
feedback:submit Submit feedback on a skill
feedback:approve Approve or reject feedback, triggering AI drafts
admin:docs Platform-admin docs reindex. Also requires the key’s creator to be a platform admin, so it is inert otherwise

MCP OAuth

Section titled “MCP OAuth”

MCP clients use a separate OAuth flow — see OAuth authentication. Sign-in still happens at console.skillist.io/login.

Sandbox policy

Section titled “Sandbox policy”

Hosted sandbox runs require authentication. Anonymous users can browse public skill scripts but cannot execute them.

Enterprise SSO (OIDC)

Section titled “Enterprise SSO (OIDC)”

Configure Better Auth generic OAuth on the API worker with:

  • SSO_CLIENT_ID / SSO_CLIENT_SECRET
  • SSO_DISCOVERY_URL or SSO_AUTHORIZATION_URL + SSO_TOKEN_URL (+ optional SSO_USERINFO_URL)
  • Optional SSO_PROVIDER_ID (default sso) and SSO_SCOPES

The web login page exposes Enterprise SSO, which calls /api/auth/sign-in/oauth2.

Local OAuth redirects

Section titled “Local OAuth redirects”
Provider Redirect URI
GitHub http://localhost:8787/api/auth/callback/github
Google http://localhost:8787/api/auth/callback/google

Production uses https://api.skillist.io/api/auth/callback/{provider}.

See apps/api/.dev.vars.example for local client IDs.