CtrlK
BlogDocsLog inGet started
Tessl Logo

adding-project-secret-api-key-auth

How to gate a PostHog API endpoint with project secret API key (PSAK) auth — a project-scoped, user-less service credential. Use when adding PSAK support to a viewset action, allowing a new scope for PSAKs, handling synthetic users (ProjectSecretAPIKeyUser), or choosing PSAK-aware rate throttles. Trigger terms: PSAK, ProjectSecretAPIKey, project secret API key, phs_ token, service auth, programmatic endpoint auth.

80

Quality

100%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

High

Do not use without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

100%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a lean, actionable guide with concrete code, a clearly sequenced four-step checklist, explicit test coverage, and well-organized self-contained sections. It assumes Claude's baseline knowledge and reserves tokens for PSAK-specific behavior.

DimensionReasoningScore

Conciseness

Dense and assumes Claude's competence (no explanation of Django, viewsets, or ClickHouse basics); every line conveys PSAK-specific facts Claude would not already know, with no padded exposition.

3 / 3

Actionability

Provides copy-paste-ready, executable snippets — the scope allowlist tuple, the viewset wiring with `psak_allowed_actions`, the RBAC-bypass guard, and a curl call — plus concrete file paths and helper function names.

3 / 3

Workflow Clarity

The "Four things, all required" numbered checklist (whitelist scope → add authenticator → use PSAK-aware throttles → handle synthetic user) is clearly sequenced, and the Testing section enumerates explicit verification cases (200/403, wrong scope, cross-team key).

3 / 3

Progressive Disclosure

Self-contained with no bundle files and well-organized sections (What a PSAK is, Wiring checklist, What you get for free, Calling an endpoint, Testing); inline paths are codebase locations, not nested reference chains, so navigation is single-level.

3 / 3

Total

12

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concrete, third-person, and well-scoped, naming several specific PSAK-related actions and an explicit "Use when" trigger clause with a broad set of natural trigger terms. It is clear, distinct, and not padded.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — "gate a PostHog API endpoint with project secret API key (PSAK) auth", "adding PSAK support to a viewset action", "allowing a new scope", "handling synthetic users", "choosing PSAK-aware rate throttles" — written in third person; not vague.

3 / 3

Completeness

Answers both what ("gate a PostHog API endpoint with PSAK auth") and when with an explicit "Use when adding PSAK support to a viewset action, allowing a new scope for PSAKs, handling synthetic users, or choosing PSAK-aware rate throttles" clause.

3 / 3

Trigger Term Quality

Explicit trigger terms cover the natural phrasings a user would say: "PSAK, ProjectSecretAPIKey, project secret API key, phs_ token, service auth, programmatic endpoint auth", spanning abbreviations, full names, and token format.

3 / 3

Distinctiveness Conflict Risk

A tightly scoped PostHog-specific niche (project secret API key auth on viewset actions) with distinctive triggers unlikely to collide with generic auth or API-key skills.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
PostHog/posthog
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.