Agent skill · software engineering · jeremylongshore
flexport-install-auth
Configure Flexport OAuth 2.0 client credentials or a deliberately accepted API key. Use when selecting endpoint scopes, creating credentials, caching access tokens, or rotating a compromised integration. Trigger with: "set up Flexport auth", "scope Flexport credentials", "cache Flexport token".
Why this skill is useful
Adds executable scripts for authenticating with the Flexport API using both API keys and OAuth, which are not commonly found in public documentation.
What it needs
Requires node, python installed locally. Requires flexport account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Flexport Credential and Token Boundary Overview Prefer a distinct endpoint-scoped OAuth client for each workload. Treat broad API keys as an explicit exception, and budget token acquisition because client-credential tokens last 24 hours while token requests are limited to 10 per day. Prerequisites Named workload owner and exact endpoint inventory Flexport administrator access to API Credentials Secret store, redacted audit sink, and rotation procedure Instructions Step 1: Choose the credential type Use OAuth client credentials for new integrations so endpoint resources can be selected. Accept an API key only after documenting why its broad access is necessary. Step 2: Create one credential per system Separate production, non-production, and independent workloads. Flexport does not let operators add endpoints to an existing credential, so create a replacement when scope must expand. Step 3: Request a token once POST to /oauth/token with clientid, clientsecret, audience https://api.flexport.com, and grant type clientcredentials. Never expose the secret in a browser, shell history, or receipt. Step 4: Cache by credential Store the JWT and expiry in a concurrency-safe cache. Refresh before expiry with jitter and a single-flight lock; do not spend the 10-request daily token budget per business request. Step 5: Prove least privilege Run one approved read against every required endpoint and one negative test against an endpoint outside the credential resource set. Step 6: Rotate without ambiguity Create and validate a replacement, switch one workload, observe it, then revoke the old credential. Record only credential aliases, timestamps, and outcome. Authentication REST calls authenticate with a cached OAuth 2.0 client-credentials Bearer token using audience https://api.flexport.com, or an explicitly accepted broad API key. Use distinct credentials per workload and never log credentials or tokens. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/flexport-install-auth