From truefoundry-gateway
List, create, and delete TrueFoundry personal access tokens (PATs) for API authentication, CI/CD pipelines, and AI Gateway access.
npx claudepluginhub truefoundry/tfy-gateway-skills --plugin truefoundry-gatewayThis skill is limited to using the following tools:
> Routing note: For ambiguous user intents, use the shared clarification templates in [references/intent-clarification.md](references/intent-clarification.md).
references/api-endpoints.mdreferences/cli-fallback.mdreferences/cluster-discovery.mdreferences/container-versions.mdreferences/gpu-reference.mdreferences/health-probes.mdreferences/intent-clarification.mdreferences/manifest-defaults.mdreferences/manifest-schema.mdreferences/prerequisites.mdreferences/resource-estimation.mdreferences/rest-api-manifest.mdreferences/tfy-api-setup.mdscripts/tfy-api.shscripts/tfy-version.shSecures ClickUp API tokens with .env storage, git pre-commit hooks, rotation via curl/gh/vault/aws, and least-privilege OAuth scopes in TypeScript.
Provides Python patterns for external service authentication using API keys, OAuth, tokens. Includes verification flows, smoke tests, env checks, and error handling with leyline.
Applies Palantir Foundry security best practices for API credentials, OAuth scopes, least privilege access, secret storage, and rotation. For securing integrations and auditing configs.
Share bugs, ideas, or general feedback.
Routing note: For ambiguous user intents, use the shared clarification templates in references/intent-clarification.md.
Manage TrueFoundry personal access tokens (PATs). List, create, and delete tokens used for API authentication, CI/CD pipelines, and AI Gateway access.
List, create, or delete personal access tokens for API authentication, CI/CD pipelines, or AI Gateway access.
Security Policy: Credential Handling
- The agent MUST NOT repeat, store, or log token values in its own responses.
- After creating a token, direct the user to copy the value from the API response output above — do not re-display it.
- Never include token values in summaries, follow-up messages, or any other output.
Run the status skill first to verify TFY_BASE_URL and TFY_API_KEY are set and valid.
If the user does not have an account or PAT yet, do not continue with the token APIs. First have them run uv run tfy register, complete any browser-based CAPTCHA or human verification the CLI requests, verify their email, open the tenant URL returned by the CLI, and create their first PAT from the tenant dashboard.
When using direct API, set TFY_API_SH to the full path of this skill's scripts/tfy-api.sh. See references/tfy-api-setup.md for paths per agent.
tfy_access_tokens_list()
TFY_API_SH=~/.claude/skills/truefoundry-access-tokens/scripts/tfy-api.sh
# List all personal access tokens
$TFY_API_SH GET /api/svc/v1/personal-access-tokens
Present results:
Personal Access Tokens:
| Name | ID | Created At | Expires At |
|---------------|----------|-------------|-------------|
| ci-pipeline | pat-abc | 2025-01-15 | 2025-07-15 |
| dev-local | pat-def | 2025-03-01 | Never |
Security: Never display token values. They are only shown once at creation time.
Ask the user for a token name before creating.
tfy_access_tokens_create(payload={"name": "my-token"})
Note: Requires human approval (HITL) via tool call.
# Create a new personal access token
$TFY_API_SH POST /api/svc/v1/personal-access-tokens '{"name":"my-token"}'
IMPORTANT: The token value is returned ONLY in the creation response.
Security: Token Display Policy
- Default to showing only a masked preview (for example: first 4 + last 4 characters).
- Show the full token only after explicit user confirmation that they are ready to copy it now.
- If a full token is shown, show it only once, in a minimal response, and never repeat it in summaries/follow-up messages.
- The agent must NEVER store, log, or re-display the token value after the initial one-time reveal.
- If the user asks to see the token again later, instruct them to create a new token.
Present the result:
Token created successfully!
Name: my-token
Token (masked): tfy_****...****
If user explicitly confirms they are ready to copy it:
One-time token: <full value from API response>
⚠️ Save this token NOW — it will not be shown again.
Store it in a password manager, CI/CD secret store, or TrueFoundry secret group.
Never commit tokens to Git or share them in plain text.
Ask for confirmation before deleting — this is irreversible and will break any integrations using the token.
tfy_access_tokens_delete(id="TOKEN_ID")
Note: Requires human approval (HITL) via tool call.
# Delete a personal access token
$TFY_API_SH DELETE /api/svc/v1/personal-access-tokens/TOKEN_ID
<success_criteria>
</success_criteria>
ai-gateway skill)status skill to verify a PAT is workingsecrets skill)See references/api-endpoints.md for the full Personal Access Tokens API reference.
Cannot manage access tokens. Check your API key permissions.
Token ID not found. List tokens first to find the correct ID.
A token with this name already exists. Use a different name.
If services fail after token deletion, they were using the deleted token.
Create a new token and update the affected services/pipelines.
Token values are only shown at creation time. If lost, delete the old token
and create a new one, then update all services that used the old token.