Skip to content
Junior

Credentials & OAuth

Credential model

Section titled “Credential model”
  • Credentials are short-lived and scoped by capability.
  • Issuance requires requester context.
  • Sandbox receives scoped header injection, not raw long-lived tokens.

OAuth model

Section titled “OAuth model”
  • Auth links are delivered privately to the requesting user.
  • Token exchange occurs server-side.
  • OAuth completion can resume the original request path.

Operational invariants

Section titled “Operational invariants”
  • Never log raw token values.
  • Never place secrets in skill files.
  • Credential failures must surface clear operator-visible errors.

Common failure classes

Section titled “Common failure classes”
  • credential_unavailable with OAuth required.
  • stale/insufficient provider token access (401/403 post-issuance).
  • provider misconfiguration (client ID/secret/redirect URL mismatch).

Next step

Section titled “Next step”