Authentication

Overview

Intertool uses GitHub OAuth for authentication. The API accepts bearer tokens issued during the OAuth flow.

The CLI handles authentication automatically:

intertool login --url https://your-registry.example.com

This opens a browser, completes the OAuth flow, and stores the token locally.

For direct API access, include the token as a Bearer header:

curl -H "Authorization: Bearer <token>" \
  https://your-registry.example.com/api/skills

Intertool supports three roles:

Role	Permissions
owner	Full access: manage settings, users, all skills, transfer ownership
admin	Manage settings, users, all skills
member	Publish, edit own skills, install any skill

Roles are assigned by admins in the registry settings. The first user to sign in becomes the owner.

Admins can restrict access to members of a specific GitHub organization. When enabled, only users who belong to the configured org can sign in.

Admins can invite new members by email. The invited person receives an email with a link to accept or decline the invitation.

An admin enters an email address in Settings > Members and clicks Invite
The invitee receives an email with an "Accept Invitation" link
Clicking the link opens the invitation page at /invite?token=...
The invitee signs in via OAuth (GitHub or Google) and accepts the invitation
They are added as a member with the role specified by the admin

Invitations expire after 7 days. Admins can revoke pending invitations at any time.

If the invitee's OAuth email matches the invitation email, the invitation is automatically accepted during sign-in. No manual acceptance is needed.

One of the following must be configured for invitations to work:

Resend (recommended)

Set the RESEND_API_KEY environment variable with your Resend API key.

SMTP (self-hosted fallback)

Set all of the following environment variables:

Optional

Variable	Description
`EMAIL_FROM`	Sender address (default: `noreply@{your-domain}`)

Method	Endpoint	Description
`POST`	`/api/members`	Send an invitation (`{ "email": "...", "role": "member" }`)
`GET`	`/api/invitations/[token]`	View invitation details (public)
`POST`	`/api/invitations/[token]`	Accept or decline (`{ "action": "accept" }` or `{ "action": "decline" }`)
`DELETE`	`/api/invitations/[token]`	Revoke an invitation (admin only)