SKILL.md
iblai-api-token
Manage the organization's Platform API Tokens — the keys that authenticate every ibl.ai API call. List the tokens, create a new Api-Token (the secret is shown only once), and delete a token by name. Tokens are platform_key-scoped, not agent-scoped.
Auth & conventions
- Base URL:
https://api.iblai.app - Header:
Authorization: Api-Token $IBLAIAPIKEYon every request. - Path vars:
{org}=$IBLAIORG,{username}=$IBLAIUSERNAME. - Host: these endpoints live under
…/dm/api/core/…. - Not connected yet? Run
/iblai-api-loginfirst to populateIBLAI_ORG,
IBLAIUSERNAME, and IBLAIAPI_KEY.
Reads
- GET
https://api.iblai.app/dm/api/core/platform/api-tokens/?platform_key={org}— list API keys.
Writes
- POST
https://api.iblai.app/dm/api/core/platform/api-tokens/— create a token (returns the secret only once):
``json { "username": "string (required)", "name": "string (required)", "key": "", "platformkey": "{org} (required)", "created": "ISO datetime (required)", "expires": "'' or seconds-string (required)", "expiresin": "seconds-string | undefined" } ``
- DELETE
https://api.iblai.app/dm/api/core/platform/api-tokens/{name}?platform_key={org}— delete a key by name. Destructive — confirm with the user first.
Example
Create a new Platform API Token named prod-integration (capture the secret from the response — it is shown only once):
curl -X POST \
"https://api.iblai.app/dm/api/core/platform/api-tokens/" \
-H "Authorization: Api-Token $IBLAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"username": "'"$IBLAI_USERNAME"'",
"name": "prod-integration",
"key": "",
"platform_key": "'"$IBLAI_ORG"'",
"created": "2026-06-12T00:00:00Z",
"expires": ""
}'Notes
- The create response returns the token secret only once — store it
immediately; it cannot be retrieved again afterward.
/iblai-api-loginuses this samePOST …/platform/api-tokens/endpoint to mint
the Api-Token it stores as IBLAIAPIKEY.
- Delete is by token name (not id), and is scoped to the org via
platform_key={org}.