Authentication

Skills Manager reuses Instructions Manager API keys. There is no separate OAuth dance for the CLI.

Console vs CLI

Client	Auth
Web UI (SaaS)	Clerk session
Web UI (on-prem)	JWT session
pm-skills	X-API-Key: elsai_… (or ?api_key=)

Create keys under Settings → API Keys. Full key lifecycle: Prompts authentication.

Impersonation model

The key identifies a user. Every skills request then applies that user’s org/project membership:

• If you are not a member of project P, pull --project P fails (403 / usage error).
• whoami / login report accessible projects — init requires at least one.
• Tier visibility follows membership (project skills for your projects, org skills for your orgs, marketplace when enabled).

CLI credential storage

pm-skills login --server <api-base> --api-key "$PM_SKILLS_API_KEY"
# → ~/.pm-skills/config.json (0600)

Prefer env vars in CI so keys are not committed:

export PM_SKILLS_API_KEY=elsai_…
export PM_SKILLS_SERVER=https://instruction-manager-api.elsai.ai

Read-only consumption

All CLI → server calls are GET. A compromised CI key can download approved skill content for projects the owner can access; it cannot approve, publish, or rewrite skills on the server.

Related

• Configuration
• Login & whoami
• SaaS / On-Prem