appium-mcp-auth: Skill for Claude Code

Mint an appium-mcp-auth API key

Produce a bearer API key for a caller and the JSON record to add to APPIUM_MCP_AUTH_API_KEYS. The server stores only the SHA-256 hash of the secret; the caller presents the full ak_<id>_<secret> credential.

Steps

1. Determine the inputs (ask only if not given):

   • id — short, unique, no underscores (e.g. ci, qa-bot, alice).
   • subject — stable identity string used for ownership/rate-limit keys.
   • kind — service (machines/CI) or user (humans). Default service.
   • scopes — e.g. ["appium:use"]. Give services and humans distinct scopes.
   • optional roles (e.g. ["admin"] bypasses scope checks) and expiresAt (epoch ms).

2. Generate a random secret and its hash, then print the credential and record. Run this (substitute the chosen values):

   node -e '
     const crypto = require("crypto");
     const id = process.argv[1], subject = process.argv[2];
     const kind = process.argv[3] || "service";
     const scopes = JSON.parse(process.argv[4] || "[]");
     const secret = crypto.randomBytes(24).toString("base64url");
     const hash = crypto.createHash("sha256").update(secret).digest("hex");
     console.log("CREDENTIAL (give to caller, store securely):");
     console.log("  ak_" + id + "_" + secret);
     console.log("\nRECORD (add to APPIUM_MCP_AUTH_API_KEYS array):");
     console.log(JSON.stringify({ id, hash, subject, kind, scopes }, null, 2));
   ' "<id>" "<subject>" "<kind>" '["appium:use"]'
   

3. Present two things clearly:

   • The credential ak_<id>_<secret> — tell the user this is shown once and to store it in their secret manager; the server never sees the plaintext.
   • The record (with hash, not secret) to append to the APPIUM_MCP_AUTH_API_KEYS JSON array in their env / .env.

Rules

• Prefer hash in committed/production config, never secret (plaintext secret is only a dev convenience that config.ts hashes at load).
• id must not contain _ (the parser splits ak_<id>_<secret> at the first underscore after the prefix). The secret may contain _.
• Do not write real secrets into files under version control. If updating a local .env, confirm it is git-ignored first.
• For rotation: add the new record, have the caller switch, then remove the old record (or set "disabled": true) — don't reuse the same id.