Discogs authentication

Skill Nikolasgrizli/discogs-api-skills/discogs-authentication

Model-agnostic Agent Skills covering the entire public Discogs API (api.discogs.com).

Install

npx -y skills add Nikolasgrizli/discogs-api-skills --skill discogs-authentication

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Reference for authenticating with the Discogs API (api.discogs.com). Make sure to use this skill whenever the task touches Discogs auth, credentials, tokens, or signed requests — even if "authentication" isn't said outright. Triggers include: choosing between a User (personal access) token, a Consumer Key/Secret pair (Discogs Auth), or the full OAuth 1.0a flow; building or fixing the Authorization header; wiring up the oauth/request_token, oauth/authorize, oauth/access_token or oauth/identity endpoints; getting 401/403 or "authentication failed" from Discogs; or troubleshooting why image URLs, the higher rate-limit tier, or per-user resources (marketplace orders, a user's collection or wantlist, private inventory fields) are missing from responses.

SKILL.md

3.0 KB, 552 tokens by cl100k_base, as published. Nobody here has run it

Discogs API — Authentication

Discogs offers three ways to authenticate. Pick based on what the request needs.

Quick decision

Method	Identifies a user?	Image URLs + high rate limit?	Use when
No auth	No	No	Public, low-volume reads only
Discogs Auth — Consumer Key/Secret	No	Yes	3rd-party app reads that don't need a specific user
Discogs Auth — User token	Yes (token holder only)	Yes	Accessing your own account (simplest secure option)
OAuth 1.0a	Yes (any user, on their behalf)	Yes	App acting for other users' accounts

Per-user resources — marketplace orders, private inventory fields, private collections — require a token or OAuth; a bare Consumer Key/Secret will not grant them.

Discogs Auth (simple)

Send credentials in the query string or an Authorization header (HTTPS required):

curl "https://api.discogs.com/database/search?q=Nirvana&token=abcxyz123456"
curl "https://api.discogs.com/database/search?q=Nirvana&key=foo123&secret=bar456"

curl "https://api.discogs.com/database/search?q=Nirvana" \
  -H "Authorization: Discogs token=abcxyz123456"
curl "https://api.discogs.com/database/search?q=Nirvana" \
  -H "Authorization: Discogs key=foo123, secret=bar456"

OAuth 1.0a (act on behalf of users)

Three server-side endpoints; PLAINTEXT signature recommended over HTTPS (oauth_signature = consumer_secret&). Flow:

Get Consumer Key/Secret from Developer Settings.
GET https://api.discogs.com/oauth/request_token → request token + secret.
Redirect user to https://discogs.com/oauth/authorize?oauth_token=… → verifier (15 min TTL).
POST https://api.discogs.com/oauth/access_token → access token + secret (do not expire; store them).
Sign every request with the access token/secret. Test with GET https://api.discogs.com/oauth/identity.

Always send a unique User-Agent. Invalid/expired OAuth requests return 400 Bad Request.

Full reference

See reference.md for the complete text: registration steps, endpoint URLs, per-step request headers, response fields, and the full credentials comparison.

Gives 0 of the 12 instructions most auth identity skills give in 552 tokens

Counted across 409 of the 410 authors here whose files we hold, read 2026-08-06

hash passwords with bcrypt or argon2in 53 of 409, across 43 files
use parameterized queriesin 47 of 409, across 39 files
load SECRET_KEY from environment variablesin 23 of 409, across 14 files
validate all input server-sidein 19 of 409, across 11 files
refresh access tokens before expiryin 17 of 409, across 9 files
store tokens in httponly cookiesin 17 of 409, across 16 files
store refresh tokens securelyin 16 of 409, across 6 files
validate webhook signatures before processingin 15 of 409, across 5 files
sanitize user inputsin 15 of 409, across 9 files
implement rate limiting on auth endpointsin 14 of 409, across 9 files
encrypt sensitive data at restin 13 of 409, across 10 files
validate uploaded file extensions and sizesin 12 of 409, across 5 files

Said here and by no other author read

select an auth method based on request needs
send Discogs Auth credentials in query string or Authorization header
use PLAINTEXT signatures for OAuth over HTTPS
store OAuth access tokens and secrets permanently
sign every OAuth request with the access token
send a unique User-Agent with every request

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.