Agent skill · software engineering · jeremylongshore
intercom-enterprise-rbac
Configure Intercom enterprise OAuth, admin roles, and app-level access control. Use when implementing OAuth integration, managing admin permissions, or setting up organization-level controls for Intercom — e.g. gating a delete endpoint by role, installing a public app for a customer workspace, or adding admin audit logging. Trigger with phrases like "intercom OAuth", "intercom RBAC", "intercom enterprise", "intercom roles", "intercom permissions", "intercom admin access".
Why this skill is useful
Provides specific implementation details and code snippets for managing OAuth and admin roles in Intercom, which the AI wouldn't generate reliably on its own.
What it needs
Requires intercom-client installed locally. Requires intercom account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Intercom Enterprise RBAC Overview Configure enterprise-grade access control for Intercom integrations with OAuth scopes, admin role management, and app-level permission enforcement. The workflow covers the full path: enumerate the workspace's admins and teams, authorize a public app with least-privilege scopes, enforce per-operation permissions at the application layer, route conversations to teams, and audit sensitive admin actions. The high-level workflow lives here; complete, copy-ready code for every step is in references/implementation.md, and end-to-end scenarios are in references/examples.md. Prerequisites Intercom workspace with admin access Understanding of OAuth 2.0 flows For public apps: OAuth configured in Developer Hub intercom-client installed and INTERCOMACCESSTOKEN (or OAuth client credentials) available in the environment Intercom Admin Roles Intercom has built-in admin roles that control workspace access: Role API Access Capabilities ------ ----------- ------------- Owner Full All operations, billing, workspace settings Admin Full Manage contacts, conversations, content Agent Limited Reply to conversations, view contacts Custom roles Configurable Enterprise plan feature These built-in roles govern access inside the Intercom UI and API. Map them onto explicit permissions (Step 3) rather than trusting the role name alone. Instructions Follow the five steps in order. Each step's full code is in references/implementation.md under the matching heading — the skeletons below show the essential call surface. Step 1: List admins and roles Enumerate every admin and team to map real identities to permissions. Step 2: OAuth scope-based access control For public apps, request the minimal scopes required, build the authorization URL with a CSRF state, and exchange the returned code for a per-workspace token. Store one token per workspace (WorkspaceAuth) for multi-tenant installs. Full exchange + storage code: see references. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/intercom-enterprise-rbac