Flowleap keys

Skill flowleap-ai/flowleap-plugins/plugins/flowleap/skills/flowleap-keys

Manage BYOK patent-provider credentials (EPO OPS consumer key/secret, USPTO ODP API key) for the FlowLeap CLI — check status, validate live, and hand off to a human for the interactive setup wizard. Trigger when a FlowLeap command fails with provider_keys_required or provider_keys_invalid, when patent data calls error about EPO/USPTO credentials, or when the user asks to configure provider keys.From its SKILL.md

Install

npx -y skills add flowleap-ai/flowleap-plugins --skill flowleap-keys

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.3 KB, 768 tokens by cl100k_base, as published. Nobody here has run it

FlowLeap Provider Keys (BYOK)

Patent data flows through provider APIs that may need the USER's own credentials: EPO OPS (consumer key + secret — always a pair) and USPTO ODP (single API key). Keys live in credentials.toml (0600) and are forwarded per-request; the CLI never prints them (verbose/dry-run redact).

Diagnose

flowleap --json keys list    # what's configured locally (masked)
flowleap --json keys test    # live verdicts: source user|server|none, valid true|false|null
flowleap --json doctor       # providerKeys section + pending steps in nextSteps

keys test needing nothing locally is fine when source is server — the backend has its own keys and commands work without BYOK.

Doctor's nextSteps lists provider keys only when they actually block work: server-covered providers produce no steps. A blocking provider appears as an obtain/store pair — obtain-epo-keys / obtain-uspto-key (actor: "human", carries the signup url — relay it to the user) then store-epo-keys / store-uspto-key (actor: "agent", carries the run command — execute it once the user hands you the keys) — followed by verify-keys (actor: "agent", runs keys test). When doctor cannot reach the validation endpoint (unauthenticated/offline) it falls back to local key presence and says so in keyValidation.note. See flowleap-shared for the full nextSteps/ready/exit contract.

The agent protocol — when keys are missing or rejected

Failed commands carry a providerKeysHint in the JSON error envelope:

"providerKeysHint": {
  "code": "provider_keys_required",      // or provider_keys_invalid
  "provider": "epo",
  "requiresHumanIntervention": true,
  "nonInteractive": { "command": "flowleap keys set epo --key … --secret …",
                       "env": ["FLOWLEAP_EPO_KEY", "FLOWLEAP_EPO_SECRET"] },
  "signup": "https://developers.epo.org (free, 'My apps' → create app)"
}

Getting keys requires a browser signup — an agent cannot complete this alone. Do not retry, do not invent keys. Tell the user:

This command needs EPO OPS credentials. Please run flowleap setup in a terminal (guided, ~2 minutes; free keys from https://developers.epo.org), then I'll continue.

If the user hands you keys directly, apply them non-interactively — they are validated live before saving, and rejected keys are NOT saved:

flowleap --json keys set epo --key <consumer-key> --secret <consumer-secret>
flowleap --json keys set uspto --key <api-key>
flowleap --json keys test

Or per-session via env: FLOWLEAP_EPO_KEY, FLOWLEAP_EPO_SECRET, FLOWLEAP_USPTO_KEY.

Human commands (mention, never run yourself)

flowleap setup — full onboarding wizard (backend check → auth check → per-provider prompts with hidden input, live validation, skippable steps with explicit warnings). Refuses to run without a TTY. flowleap keys rm epo|uspto removes stored keys.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.