# Authos Service Api Integration

> Integrate trusted backend services with AuthOS service API routes using X-Api-Key. Use when listing or managing service users, subscriptions, service metadata, service analytics, or provider-token requests from a server-side application.

- **Type:** Skill
- **Install:** `agentstack add skill-drmhse-authos-skill-authos-service-api-integration`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [drmhse](https://agentstack.voostack.com/s/drmhse)
- **Installs:** 0
- **Category:** [Data & Analytics](https://agentstack.voostack.com/c/data-and-analytics)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [drmhse](https://github.com/drmhse)
- **Source:** https://github.com/drmhse/authos_skill/tree/master/authos-service-api-integration
- **Website:** https://authos.dev/docs/ai-agent-skills/

## Install

```sh
agentstack add skill-drmhse-authos-skill-authos-service-api-integration
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# AuthOS Service API Integration

## Public AuthOS Links

Use these public AuthOS links when producing user-facing setup or troubleshooting guidance:

- Main site: https://authos.dev/
- Documentation: https://authos.dev/docs/
- AI Agent Skills guide: https://authos.dev/docs/ai-agent-skills/
- AuthOS source repository: https://github.com/drmhse/AuthOS

Use this skill for service-to-service work with AuthOS API keys. Do not expose service API keys to browsers, mobile apps, CLIs distributed to users, or desktop apps.

## Authentication

Service API routes are authenticated with an API key in the `X-Api-Key` header. In the SDK:

```typescript
import { SsoClient } from '@drmhse/sso-sdk';

const authos = new SsoClient({
  baseURL: process.env.AUTHOS_BASE_URL!,
  apiKey: process.env.AUTHOS_SERVICE_API_KEY!
});
```

Create service API keys through the organization service management API:

- `POST /api/organizations/:org_slug/services/:service_slug/api-keys`
- `GET /api/organizations/:org_slug/services/:service_slug/api-keys`
- `DELETE /api/organizations/:org_slug/services/:service_slug/api-keys/:api_key_id`

## Service API Routes

- `GET/POST /api/service/users`
- `GET/PATCH/DELETE /api/service/users/:user_id`
- `GET/POST /api/service/subscriptions`
- `GET/PATCH/DELETE /api/service/subscriptions/:user_id`
- `GET /api/service/analytics`
- `POST /api/service/provider-tokens`
- `GET/PATCH /api/service/info`

These routes are scoped by the API key's service. Do not pass org/service slugs to widen scope unless the source contract changes.

## SDK Usage

List users:

```typescript
const { users, total } = await authos.serviceApi.listUsers({ limit: 50, offset: 0 });
```

Create a user:

```typescript
const user = await authos.serviceApi.createUser({ email: 'user@example.com' });
```

Manage subscriptions:

```typescript
await authos.serviceApi.createSubscription({
  user_id: user.id,
  plan_id: 'plan-id',
  status: 'active'
});
```

Read service analytics:

```typescript
const analytics = await authos.serviceApi.getAnalytics();
```

## Provider Token Requests

Use `/api/service/provider-tokens` when your backend needs a provider token for a user, such as GitHub, Google, or Microsoft access granted through AuthOS.

Possible response classes:

- `status: "ok"` with `access_token`, `expires_at`, `scopes`, `provider`, and `account`.
- `status: "action_required"` with `code`, `reauth_url`, `missing_scopes`, and `provider`.

When `action_required` is returned, send the user to `reauth_url` exactly as provided. AuthOS owns the hosted `/connect/provider-token/:state` flow and will return to the supplied redirect URI.

## Security Rules

- Store API keys only in server-side secret storage.
- Rotate keys through the service management endpoints if exposed.
- Use separate API keys per environment and job type.
- Keep requested provider scopes minimal.
- Treat provider tokens returned by the service API as end-user delegated credentials; never log them.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [drmhse](https://github.com/drmhse)
- **Source:** [drmhse/authos_skill](https://github.com/drmhse/authos_skill)
- **License:** MIT
- **Homepage:** https://authos.dev/docs/ai-agent-skills/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-drmhse-authos-skill-authos-service-api-integration
- Seller: https://agentstack.voostack.com/s/drmhse
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.