development

Comprehensive security patterns for managing authentication in GitHub Agentic Workflows including GitHub token types, credential storage, token rotation, least privilege access control, MCP server authentication, and API key management best practices.

Jump to install

Repository: Hack23/riksdagsmonitor
Last source activity: April 26, 2026 at 17:53
Detected SKILL.md language: English
Stars: 9
Forks: 3

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/Hack23/riksdagsmonitor --skill development

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

gh-aw-workflow-authoring

Master GitHub Agentic Workflows authoring - markdown syntax, natural language instructions, YAML frontmatter, compilation, and workflow patterns

2026-05-31

github-agentic-workflows

Comprehensive expertise in GitHub Agentic Workflows (v0.68.1) — AI-powered repository automation with five-layer security, safe outputs, MCP tools, and Continuous AI patterns

2026-05-31

github-agentic-workflows-mcp-configuration

Comprehensive guide for MCP (Model Context Protocol) server setup, transport protocols, configuration validation, lifecycle management, tool discovery, and error handling patterns

2026-05-31

View all from this repository

name	Authentication and Credentials for Agentic Workflows
description	Comprehensive security patterns for managing authentication in GitHub Agentic Workflows including GitHub token types, credential storage, token rotation, least privilege access control, MCP server authentication, and API key management best practices.
license	Apache-2.0
version	2.0.0
last_updated	2026-04-02
tags	["authentication","credentials","security","agentic-workflows","github-tokens","api-keys","secrets-management","least-privilege","token-rotation","mcp-authentication"]

🔐 Authentication and Credentials for Agentic Workflows

🔴 AI FIRST Quality Principle

Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.

📋 Overview

This skill provides comprehensive security patterns for managing authentication and credentials in GitHub Agentic Workflows. It covers GitHub token types, secure credential storage, token rotation strategies, least privilege access control, MCP server authentication, and API key management best practices for production-ready autonomous agent systems.

// scripts/agents/lib/github-app-auth.js import { createAppAuth } from '@octokit/auth-app'; import { Octokit } from '@octokit/rest'; import fs from 'fs'; /** * GitHub App authentication for agentic workflows */ class GitHubAppAuth { constructor(options = {}) { this.appId = options.appId || process.env.GITHUB_APP_ID; this.privateKey = options.privateKey || process.env.GITHUB_APP_PRIVATE_KEY; this.installationId = options.installationId || process.env.GITHUB_APP_INSTALLATION_ID; if (!this.appId || !this.privateKey) { throw new Error('GitHub App credentials not configured'); } } /** * Create authenticated Octokit instance */ async createOctokit() { const auth = createAppAuth({ appId: this.appId, privateKey: this.privateKey, installationId: this.installationId }); const { token } = await auth({ type: 'installation' }); return new Octokit({ auth: token, userAgent: 'agentic-workflow-bot/1.0.0' }); } /** * Get installation token (for direct use) */ async getInstallationToken() { const auth = createAppAuth({ appId: this.appId, privateKey: this.privateKey, installationId: this.installationId }); const { token, expiresAt, permissions } = await auth({ type: 'installation' }); return { token, expiresAt: new Date(expiresAt), permissions }; } /** * Revoke installation token (cleanup) */ async revokeToken(token) { const octokit = new Octokit({ auth: token }); await octokit.apps.deleteToken({ client_id: this.appId, access_token: token }); } } export default GitHubAppAuth; // Usage in workflow const appAuth = new GitHubAppAuth({ appId: process.env.GITHUB_APP_ID, privateKey: process.env.GITHUB_APP_PRIVATE_KEY, installationId: process.env.GITHUB_APP_INSTALLATION_ID }); const octokit = await appAuth.createOctokit(); // Use octokit for API calls const { data: pr } = await octokit.pulls.get({ owner: 'owner', repo: 'repo', pull_number: 123 });

// scripts/agents/lib/credential-manager.js import { SecretsManager } from '@aws-sdk/client-secrets-manager'; import crypto from 'crypto'; /** * Secure credential manager for agentic workflows */ class CredentialManager { constructor(options = {}) { this.secretsClient = options.secretsClient || new SecretsManager({ region: process.env.AWS_REGION || 'us-east-1' }); this.cache = new Map(); this.cacheTTL = options.cacheTTL || 300000; // 5 minutes } /** * Get secret with caching */ async getSecret(secretName, options = {}) { // Check cache const cached = this.cache.get(secretName); if (cached && Date.now() - cached.timestamp < this.cacheTTL) { return cached.value; } // Retrieve from secrets manager let secret; if (secretName.startsWith('aws:')) { secret = await this.getAWSSecret(secretName.replace('aws:', '')); } else if (secretName.startsWith('env:')) { secret = process.env[secretName.replace('env:', '')]; } else { throw new Error(`Unknown secret source for: ${secretName}`); } // Cache secret this.cache.set(secretName, { value: secret, timestamp: Date.now() }); return secret; } /** * Get secret from AWS Secrets Manager */ async getAWSSecret(secretId) { const response = await this.secretsClient.getSecretValue({ SecretId: secretId }); if (response.SecretString) { return JSON.parse(response.SecretString); } else { throw new Error(`Secret ${secretId} is not a string`); } } /** * Rotate secret */ async rotateSecret(secretName, newValue) { if (secretName.startsWith('aws:')) { await this.rotateAWSSecret(secretName.replace('aws:', ''), newValue); } // Invalidate cache this.cache.delete(secretName); } /** * Rotate AWS secret */ async rotateAWSSecret(secretId, newValue) { await this.secretsClient.updateSecret({ SecretId: secretId, SecretString: JSON.stringify(newValue) }); } /** * Mask sensitive values in logs */ maskSecret(value) { if (!value || value.length < 8) return '***'; // Show first and last 4 characters return `${value.slice(0, 4)}...${value.slice(-4)}`; } /** * Validate secret format */ validateSecret(secret, type) { switch (type) { case 'github-token': // GitHub tokens start with specific prefixes return /^(ghp_|gho_|ghu_|ghs_|ghr_)/.test(secret); case 'anthropic-key': return /^sk-ant-api03-/.test(secret); case 'openai-key': return /^sk-/.test(secret); default: return true; } } /** * Clear cache (on shutdown) */ clearCache() { this.cache.clear(); } } export default CredentialManager; // Usage const credManager = new CredentialManager(); // Get secret const apiKey = await credManager.getSecret('aws:agentic-workflow/api-key'); // Mask in logs console.log(`Using API key: ${credManager.maskSecret(apiKey)}`); // Validate if (!credManager.validateSecret(apiKey, 'anthropic-key')) { throw new Error('Invalid API key format'); }

# .github/workflows/rotate-secrets.yml name: Rotate Secrets on: schedule: - cron: '0 0 1 * *' # Monthly rotation workflow_dispatch: permissions: contents: read issues: write jobs: check-expiration: name: Check Token Expiration runs-on: ubuntu-latest outputs: needs_rotation: ${{ steps.check.outputs.needs_rotation }} steps: - name: Check PAT Expiration id: check env: GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }} run: | # Get token expiration EXPIRATION=$(gh api /user \ -H "Accept: application/vnd.github+json" \ | jq -r '.token_expires_at // "never"') if [ "$EXPIRATION" = "never" ]; then echo "⚠️ Token has no expiration (not recommended)" echo "needs_rotation=false" >> $GITHUB_OUTPUT exit 0 fi # Calculate days until expiration EXPIRE_DATE=$(date -d "$EXPIRATION" +%s) NOW=$(date +%s) DAYS_LEFT=$(( ($EXPIRE_DATE - $NOW) / 86400 )) echo "Days until expiration: $DAYS_LEFT" if [ $DAYS_LEFT -lt 14 ]; then echo "⚠️ Token expires in $DAYS_LEFT days - rotation needed" echo "needs_rotation=true" >> $GITHUB_OUTPUT else echo "✅ Token valid for $DAYS_LEFT days" echo "needs_rotation=false" >> $GITHUB_OUTPUT fi notify-rotation: name: Notify About Rotation needs: check-expiration if: needs.check-expiration.outputs.needs_rotation == 'true' runs-on: ubuntu-latest steps: - name: Create Rotation Issue uses: actions/github-script@v7 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | // Check if rotation issue already exists const { data: issues } = await github.rest.issues.listForRepo({ owner: context.repo.owner, repo: context.repo.repo, state: 'open', labels: 'security,credential-rotation', per_page: 10 }); const existingIssue = issues.find(issue => issue.title.includes('Token Rotation Required') ); if (existingIssue) { console.log('Rotation issue already exists:', existingIssue.number); return; } // Create new rotation issue await github.rest.issues.create({ owner: context.repo.owner, repo: context.repo.repo, title: '🔐 Token Rotation Required', body: `## Security Notice The GitHub Personal Access Token used by agentic workflows is expiring soon. ### Action Required 1. Go to [GitHub Settings → Personal Access Tokens](https://github.com/settings/tokens) 2. Generate a new fine-grained token with same permissions 3. Update repository secret: \`COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN\` 4. Test workflows after rotation 5. Close this issue ### Token Details - **Current Status**: Expires in < 14 days - **Used In**: Agentic workflow automations - **Permissions**: Contents, PRs, Issues, Workflows --- *Auto-generated rotation reminder*`, labels: ['security', 'credential-rotation', 'high-priority'], assignees: ['security-team'] });

// scripts/mcp-servers/authenticated-mcp.js import { McpServer } from '@modelcontextprotocol/sdk'; import { createHmac, timingSafeEqual } from 'crypto'; /** * Custom MCP server with authentication */ class AuthenticatedMCPServer extends McpServer { constructor(options = {}) { super(options); this.apiKey = options.apiKey || process.env.MCP_API_KEY; this.allowedOrigins = options.allowedOrigins || ['localhost']; if (!this.apiKey) { throw new Error('MCP_API_KEY not configured'); } // Add authentication middleware this.use(this.authenticateRequest.bind(this)); } /** * Authenticate incoming requests */ async authenticateRequest(req, res, next) { const authHeader = req.headers['authorization']; if (!authHeader) { return res.status(401).json({ error: 'Missing Authorization header' }); } const [type, credentials] = authHeader.split(' '); if (type === 'Bearer') { // API key authentication if (!this.validateAPIKey(credentials)) { return res.status(401).json({ error: 'Invalid API key' }); } } else if (type === 'HMAC') { // HMAC signature authentication if (!this.validateHMACSignature(req, credentials)) { return res.status(401).json({ error: 'Invalid HMAC signature' }); } } else { return res.status(401).json({ error: 'Unsupported authentication type' }); } next(); } /** * Validate API key */ validateAPIKey(providedKey) { // Use timing-safe comparison const expected = Buffer.from(this.apiKey); const provided = Buffer.from(providedKey); if (expected.length !== provided.length) { return false; } return timingSafeEqual(expected, provided); } /** * Validate HMAC signature */ validateHMACSignature(req, signature) { const payload = JSON.stringify(req.body); const hmac = createHmac('sha256', this.apiKey); hmac.update(payload); const expected = hmac.digest('hex'); return timingSafeEqual( Buffer.from(expected), Buffer.from(signature) ); } /** * Generate HMAC signature for client */ static generateSignature(payload, apiKey) { const hmac = createHmac('sha256', apiKey); hmac.update(JSON.stringify(payload)); return hmac.digest('hex'); } } export default AuthenticatedMCPServer;

// scripts/agents/lib/api-key-manager.js /** * Manage API keys for multiple providers */ class APIKeyManager { constructor() { this.keys = { anthropic: process.env.ANTHROPIC_API_KEY, openai: process.env.OPENAI_API_KEY, github: process.env.GITHUB_TOKEN, riksdag: process.env.RIKSDAG_API_TOKEN }; this.usage = new Map(); this.rateLimits = { anthropic: { requests: 50, period: 60000 }, // 50/min openai: { requests: 60, period: 60000 }, // 60/min github: { requests: 5000, period: 3600000 } // 5000/hour }; } /** * Get API key for provider */ getKey(provider) { const key = this.keys[provider]; if (!key) { throw new Error(`API key not configured for provider: ${provider}`); } return key; } /** * Check rate limit before API call */ async checkRateLimit(provider) { const limit = this.rateLimits[provider]; if (!limit) return true; const usage = this.usage.get(provider) || { count: 0, resetAt: Date.now() + limit.period }; // Reset if period expired if (Date.now() >= usage.resetAt) { usage.count = 0; usage.resetAt = Date.now() + limit.period; } // Check limit if (usage.count >= limit.requests) { const waitTime = usage.resetAt - Date.now(); throw new Error( `Rate limit exceeded for ${provider}. ` + `Wait ${Math.ceil(waitTime / 1000)}s before next request.` ); } // Increment usage usage.count++; this.usage.set(provider, usage); return true; } /** * Make authenticated API call */ async callAPI(provider, url, options = {}) { await this.checkRateLimit(provider); const key = this.getKey(provider); const headers = this.getAuthHeaders(provider, key); const response = await fetch(url, { ...options, headers: { ...headers, ...options.headers } }); return response; } /** * Get auth headers for provider */ getAuthHeaders(provider, key) { switch (provider) { case 'anthropic': return { 'x-api-key': key, 'anthropic-version': '2023-06-01' }; case 'openai': return { 'Authorization': `Bearer ${key}` }; case 'github': return { 'Authorization': `Bearer ${key}`, 'Accept': 'application/vnd.github+json', 'X-GitHub-Api-Version': '2022-11-28' }; default: return { 'Authorization': `Bearer ${key}` }; } } } export default APIKeyManager;

development

Source facts

Install options

Review the source files

More from this repository

More from this repository

🔐 Authentication and Credentials for Agentic Workflows

🔴 AI FIRST Quality Principle

📋 Overview

🔐 Authentication and Credentials for Agentic Workflows

🔴 AI FIRST Quality Principle

📋 Overview

🎯 Core Concepts

Authentication Architecture

Security Principles

🔑 GitHub Token Types

1. GITHUB_TOKEN (Automatic)

Characteristics

Usage Pattern

Limitations

2. Personal Access Token (PAT)

Classic PAT Configuration

Fine-Grained PAT (Recommended)

Usage in Workflows

3. GitHub App Token

App Creation and Configuration

Generate Installation Token

Workflow Integration

🔒 Credential Storage

1. GitHub Secrets

Repository Secrets

Environment Secrets

Organization Secrets

2. External Secret Managers

AWS Secrets Manager

HashiCorp Vault

3. Secure Secret Handling

🔄 Token Rotation

1. Automated Rotation Strategy

2. Zero-Downtime Rotation

🛡️ Least Privilege Access

1. Granular Permissions

2. Permission Validation

🔌 MCP Server Authentication

1. GitHub MCP Server

2. Custom MCP Server with Auth

3. MCP Client Authentication

🔑 API Key Management

1. Multi-Provider Key Management

🔒 Security Best Practices

1. Secret Scanning

2. Credential Auditing

📚 Related Skills

🔗 References

GitHub Documentation

Security Best Practices

✅ Remember Checklist

🔗 Integration with Riksdagsmonitor agentic workflows