Secrets and provider connections

Skilleo does not store customer provider API keys. You manage keys in your secret store. Skilleo stores only a provider connection — provider, connection_type, and secret_ref (a pointer).

Agents never see credentials. They call capabilities; Skilleo resolves connections at runtime.

What you register

Response shape (metadata only — no secrets):

{
  "provider": "minimax",
  "connection": "prv_…",
  "connection_type": "environment",
  "secret_ref": "MINIMAX_API_KEY",
  "status": "connected"
}

No provider api_key in requests or responses.

connection_type	secret_ref	Where the key lives
environment	Variable name	Your secret store (self-host)
aws_secrets_manager	Secret ARN or name	Your AWS account
gcp_secret_manager	Secret resource id	Your GCP project
provider_native	Provider handle	Provider (when supported)

API

Method	Path
POST	/v1/providers/connections
GET	/v1/providers/connections
DELETE	/v1/providers/connections/{id}
PUT	/v1/account/credentials (same register shape)

Sending a provider api_key in the body is rejected.

# 1. Put the key in YOUR secret store (not in the Skilleo API)
export MINIMAX_API_KEY='...'

# 2. Register where to resolve it — pointer only
curl -s -X POST https://api.skilleo.org/v1/providers/connections \
  -H "Authorization: Bearer $SKILLEO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"provider":"minimax","connection_type":"environment","secret_ref":"MINIMAX_API_KEY"}'

SDK

# 1. Put the key in YOUR secret store (not in the Skilleo API)
# export MINIMAX_API_KEY=...

# 2. Register where to resolve it — pointer only
client.providers.register(
    "minimax",
    connection_type="environment",
    secret_ref="MINIMAX_API_KEY",
)

client.providers.connect("runpod")  # default secret_ref RUNPOD_API_KEY

Cloud secret manager:

client.providers.register(
    "openai",
    connection_type="aws_secrets_manager",
    secret_ref="arn:aws:secretsmanager:...:secret/openai",
)

Skilleo API key vs provider keys

Key	Purpose
sk_live_…	Authenticates you to Skilleo /v1
Provider secret	Used by capabilities — stays in your store

Keep provider secrets out of source control and client-side logs.