API integrations and AI agents

An API key lets your own software — an HR system, a reporting script or an AI agent — work with your organization's data without a person logging in. The key belongs to the organization, not to you, so it keeps working when you change jobs, and you can revoke it in one click.

Create a key

1. 1Open Organization → Settings → Integrations. Developers create their keys in Applications → Integrations.
2. 2Click Create key.
3. 3Name it after the tool that will use it — that is the name you will see in the request log.
4. 4Pick the roles the key gets: Admin, Analyst or Device admin. A key can never do more than you can, so you only see the roles you hold yourself.
5. 5Pick the scope: Read only or Read and write.
6. 6Pick how long it stays valid: 30, 90 or 365 days.

We show the key once, right after creating it. Copy it into your password manager or your secret store before closing the window. If you lose it, rotate the key and use the new one.

What the key looks like

Every key starts with sk_live_, for example sk_live_7Hq2mZk1_…. The panel stores only its hash and the visible prefix, which is why we cannot show you the full key again.

Send it in the Authorization header:

Authorization: Bearer sk_live_7Hq2mZk1_…

Roles and scope

• Roles decide what data the key sees — exactly the same rules as for a person in that role.
• Scope decides what it may do: a read-only key is rejected with 403 on every write.
• The key works only inside the organization it was created in. It cannot reach the panel (api/web) at all.

Expiry and rotation

A key stops working the moment it expires. Rotate gives you a new key value while the old one keeps working for another 24 hours — enough to redeploy your tool without downtime. Revoke kills a key immediately; every call with it is rejected within a minute.

Limits

• 10 active keys per organization and per context.
• 120 requests per minute per key. Above that the API answers 429 with a Retry-After header.

The request log

The Request log card on the same page lists every call made with a key of this organization: the key, the method and path, the response status and how long it took. Filter it by key or by status when you are debugging an integration. Entries are kept for 90 days.

The API reference

The full list of endpoints, request and response shapes lives in the public OpenAPI document: api.skillsive.com/core/swagger. Pick the public document in the selector at the top.

Connect an AI agent (MCP)

The same key authenticates you to the Skillsive MCP server at https://api.skillsive.com/core/mcp, which exposes the API as tools an agent can call directly.

Claude Code — one command in your terminal:

claude mcp add --transport http skillsive https://api.skillsive.com/core/mcp --header "Authorization: Bearer sk_live_…"

Cursor — add the server to ~/.cursor/mcp.json (or .cursor/mcp.json in the project):

{
	"mcpServers": {
		"skillsive": {
			"type": "http",
			"url": "https://api.skillsive.com/core/mcp",
			"headers": { "Authorization": "Bearer sk_live_…" }
		}
	}
}