skopik

Auth

Skopik's public API authenticates server-side integrations with API keys. Send the key as a bearer token on every request.

Use an API key

Keep the secret in your server's secret manager or environment. Do not embed it in browser code, mobile apps, source control, logs, or error reports.

export SKOPIK_API_KEY="sk_live_..."

The SDK adds the authorization header for you:

import { createSkopikClient } from '@skopiklabs/sdk'

const skopik = createSkopikClient({
	apiKey: process.env.SKOPIK_API_KEY,
})

For raw HTTP requests:

curl "https://api.skopik.com/api/v1/agents" \
  -H "Authorization: Bearer $SKOPIK_API_KEY"

Permissions

Choose the lowest permission that can perform the integration's job.

Permission Use it for
read Listing and reading platform resources.
write Creating Agents, opening Sessions, and changing platform resources.
admin Managing API keys and Environment secrets in addition to read/write access.

Key-management endpoints require an admin key. A key cannot grant access beyond the account it belongs to.

Create a key

Create your first key in the Skopik Console. An existing admin key can create additional keys through the SDK:

const { apiKey } = await skopik.keys.create({
	name: 'production-worker',
	permission: 'write',
	expiresAt: '2026-12-31T23:59:59.000Z',
})

console.log(apiKey.keyId)
console.log(apiKey.secret)

The plaintext secret is returned only when a key is created or rotated. Store it before discarding the response. Later reads return identifying metadata and secretPreview, never the secret.

List and inspect keys

const { data, page } = await skopik.keys.list({ limit: 50 })
const { apiKey } = await skopik.keys.get(data[0].keyId)

console.log(apiKey.name, apiKey.permission, apiKey.lastUsedAt)

List results use cursor pagination. When page.hasMore is true, pass page.nextCursor as cursor on the next call.

Change a key

You can change a key's display name, permission, or metadata. Updating a key does not change its secret.

const { apiKey } = await skopik.keys.update(keyId, {
	name: 'production-reader',
	permission: 'read',
})

Rotate a key

Rotation invalidates the old secret immediately and returns a new secret once. Deploy the replacement safely before rotating a key that is in active use.

const { apiKey } = await skopik.keys.rotate(keyId)
await secretManager.store('SKOPIK_API_KEY', apiKey.secret)

Delete a key

Deleting a key permanently revokes it:

await skopik.keys.delete(keyId)

Authentication errors

Status Meaning Recovery
401 The bearer token is missing, malformed, expired, rotated, or deleted. Load the current secret and retry.
403 The key is valid but lacks the required permission. Use an appropriately scoped key; do not broaden unrelated keys.

The SDK throws SkopikApiError for both cases. Inspect status, code, and requestId without logging the credential.