CtrlK
BlogDocsLog inGet started
Tessl Logo

adding-project-secret-api-key-auth

How to gate a PostHog API endpoint with project secret API key (PSAK) auth — a project-scoped, user-less service credential. Use when adding PSAK support to a viewset action, allowing a new scope for PSAKs, handling synthetic users (ProjectSecretAPIKeyUser), or choosing PSAK-aware rate throttles. Trigger terms: PSAK, ProjectSecretAPIKey, project secret API key, phs_ token, service auth, programmatic endpoint auth.

74

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

High

Do not use without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a strong, executable wiring guide with concrete code, explicit failure modes, and a testing matrix. Minor gains are available from trimming the legacy-token aside and stating an explicit validate-and-retry loop.

Suggestions

Move the TeamSecretTokenAuthentication disambiguation into a short 'Don't confuse with' footnote or omit it unless directly relevant, to tighten conciseness.

Add an explicit validation feedback loop after the testing checklist (e.g., 'run the matrix; on failure, fix the scope/action wiring and re-run') to push workflow clarity to 5.

If the body grows further, split the throttle and synthetic-user guidance into a reference file linked from the main checklist to preserve progressive disclosure.

DimensionReasoningScore

Conciseness

Lean and assumes Django/DRF knowledge with no elementary padding, but the legacy TeamSecretTokenAuthentication disambiguation and the 'first planned consumer' aside are slightly more than needed.

4 / 5

Actionability

Provides four executable code blocks (scope allowlist, viewset wiring, isinstance branch, curl call), exact source paths, and named throttle classes with cache-key details — copy-paste ready and covering common cases.

5 / 5

Workflow Clarity

A clear numbered four-step checklist with explicit per-step failure behavior and a concrete test matrix as the validation gate, though a validate→fix→re-run loop is implied rather than spelled out.

4 / 5

Progressive Disclosure

Well-organized into clear sections with all wiring content appropriately inline and real source-path pointers; no bundle files exist, and the >50-line body keeps it just short of a 5.

4 / 5

Total

17

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: third-person, concise, with a clear what/when structure, comprehensive trigger terms, and a distinctive niche that minimizes conflict risk. No changes needed.

DimensionReasoningScore

Specificity

Names the domain (PSAK auth on PostHog endpoints) and lists multiple concrete actions — adding viewset support, allowing scopes, handling synthetic users, choosing rate throttles — giving comprehensive coverage.

5 / 5

Completeness

Clearly states what the skill does (gate an endpoint with a project-scoped, user-less credential) and provides an explicit 'Use when...' clause with concrete trigger scenarios.

5 / 5

Trigger Term Quality

Explicit 'Trigger terms' clause covers synonyms (PSAK, ProjectSecretAPIKey, project secret API key), the token format (phs_), and natural phrasings (service auth, programmatic endpoint auth).

5 / 5

Distinctiveness Conflict Risk

A narrow PostHog-specific niche with distinctive triggers like the phs_ token and ProjectSecretAPIKeyUser, making overlap with other skills minimal.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
PostHog/posthog
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.