Agent and CLI access
The hosted video2ctx skills use the public CLI package. Install it once, then start device authorization:
The command opens video2ctx.dev and displays a short code. Sign in, confirm that the code and account are correct, and approve the device. The CLI stores the resulting revocable session in local user configuration with private file permissions. Check it with video2ctx auth status --json or video2ctx whoami --json, and revoke it with video2ctx auth logout.
CLI sessions carry data:read and account:access. They can use provider data, usage, monitors, and notifications. API-key management, billing, connected-account changes, account deletion, and administration remain browser-session-only.
Personal API keys
For unattended server-to-server applications, create a personal key and use the standard Authorization header:
X-API-Key remains available for compatibility, but bearer authentication is preferred. Browser sessions, CLI sessions, and API keys share the same account and credit ledger.
Permissions
Personal API keys can access normal user-owned data, projects, imports, exports, monitors, notifications, and usage. The published agent skills intentionally expose a narrower surface; the public OpenAPI contract remains the source of truth for each route’s accepted credential type.
Key safety
- Keep keys in server-side secrets or environment variables.
- Never embed a key in a public web bundle or mobile application.
- Use separate keys for separate integrations so one can be revoked independently.
- Revoke a key immediately if it appears in logs, screenshots, source control, or support messages.
Never paste a CLI session or API key into an agent prompt. Local demo identities are development-only; production rejects the X-Demo-User header.
