Agent skill · software engineering · jeremylongshore
miro-install-auth
Design and implement a production Miro REST authorization flow with least-privilege scopes, tenant-bound storage, token rotation, and an approval-gated installation handoff. Use when installing or repairing Miro authorization. Trigger with \"set up Miro OAuth\".
Why this skill is useful
Adds specific OAuth 2.0 authentication patterns and Miro API integration steps that the AI wouldn't reliably generate on its own.
What it needs
Requires node installed locally. Requires miro account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Miro OAuth Installation and Token Lifecycle Overview Establish an auditable authorization boundary before any board operation. Prefer expiring-token apps and prove tenant context without exposing credentials; use the evidence produced here to make the next decision explicit and reviewable. Prerequisites A Miro Developer team and an app configuration for the target environment Approved redirect URIs and a server-side encrypted token store A capability-to-scope map and accountable installation owner Tool Discipline Use Read, Glob, and Grep to inspect the repository, configuration names, adapters, tests, and evidence. Use WebFetch only for current official Miro documentation. Use Write or Edit after confirming the requested mode, target environment, tenant, board, and approval boundary. These declared tools do not call authenticated Miro APIs or deployment CLIs; implement client, configuration, and test changes, then return exact operator commands or an approval-gated handoff for live execution. Current Contract REST apps use OAuth 2.0 Authorization Code; authorization starts at https://miro.com/oauth/authorize and exchange uses https://api.miro.com/v1/oauth/token. The REST resource base is https://api.miro.com/v2; OAuth endpoints remain v1 and are not deprecated by the REST v2 migration. Expiring-token mode provides a one-hour access token and a sixty-day refresh token; refresh rotates both values and invalidates the prior pair. Token-expiration mode is chosen when the app is created and cannot later be enabled, disabled, or changed. Authentication For REST work, use OAuth 2.0 Authorization Code with the narrowest Miro scopes. Bind each encrypted token record to its user, application, authorized team, and granted scopes. Never print access tokens, refresh tokens, client secrets, authorization codes, or board content. Instructions 1. Inventory environments, redirect URIs, requested capabilities, scopes, and installation owners. 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/miro-install-auth