Menu
Configure the OneCLI Gateway API key for Codex. Use when the user asks to set up OneCLI, configure OneCLI, or invokes /onecli-setup.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
OneCLI Gateway: transparent HTTPS proxy that injects stored credentials into outbound calls. Only use this skill when prompted by the gateway detection hook or when the user explicitly invokes /onecli-gateway. Do NOT auto-load this skill based on user intent alone — the hook handles detection.
Reference of all services supported by OneCLI gateway with their endpoints, auth patterns, and connection methods. Use when you need to know which APIs are available or how to call a specific service.
Design multi-service API integrations through OneCLI Gateway. Use when building workflows that combine GitHub, Google, AWS, Atlassian, or other services through the OneCLI proxy.
Clean up the OneCLI Gateway environment file for Codex. Use when the user asks to deactivate OneCLI, uninstall OneCLI, clean up gateway state, or check Claude SessionEnd parity.
OneCLI Gateway for Codex: transparent HTTPS proxy instructions for outbound calls with OneCLI-managed credentials. Use when prompted by the OneCLI session hook or when the user explicitly asks to use OneCLI Gateway.
Reference of services supported by OneCLI Gateway, including endpoints, authentication patterns, and connection behavior. Use when planning or making calls to a specific service through OneCLI.
| name | onecli-setup |
| description | Configure the OneCLI Gateway API key for Codex. Use when the user asks to set up OneCLI, configure OneCLI, or invokes /onecli-setup. |
| metadata | {"priority":7} |
Configure OneCLI once, then start a new Codex thread so the session-start hook
can write ~/.onecli/env.sh as a non-secret loader.
test -s ~/.onecli/credentials/api-key && echo "FOUND" || echo "NOT_FOUND"
If a key exists, verify it:
curl -s -o /dev/null -w "%{http_code}" \
-H "Authorization: Bearer $(cat ~/.onecli/credentials/api-key)" \
https://app.onecli.sh/api/container-config
If the response is 200, tell the user OneCLI is already configured.
If no key exists, tell the user:
Open https://app.onecli.sh/projects, select or create a project, copy the API
key from the Overview page, and paste it here.
The key should start with oc_.
After the user provides the key, store it without printing it back:
umask 077
mkdir -p ~/.onecli/credentials
printf '%s' "USER_PROVIDED_KEY" > ~/.onecli/credentials/api-key
printf '%s\n' '{"api-host":"https://app.onecli.sh"}' > ~/.onecli/config.json
chmod 600 ~/.onecli/credentials/api-key ~/.onecli/config.json
curl -s -o /dev/null -w "%{http_code}" \
-H "Authorization: Bearer USER_PROVIDED_KEY" \
https://app.onecli.sh/api/container-config
If the response is 200, tell the user setup succeeded and they should start a
new Codex thread. The loader file does not store live proxy credentials; it
fetches gateway exports when sourced. If they need to use the gateway in the
current thread, resolve the plugin root as the directory two levels above this
SKILL.md and run:
node "<plugin-root>/hooks/session-start.mjs"
If the response is 401, ask the user to check the key in the OneCLI dashboard.