What problem does it solve?
Adding programmatic, service-style authentication to a PostHog API endpoint requires coordinating several pieces: scope allowlists, authenticator classes, action opt-ins, rate throttles, and synthetic user handling. This Skill walks through the complete checklist for wiring project secret API key (PSAK) auth to a viewset action without missing any required step.
Core Features & Use Cases
- Scope and action allowlisting: Add the (scope_object, action) tuple to PROJECT_SECRET_API_KEY_ALLOWED_API_SCOPE_ACTION and opt in actions via psak_allowed_actions, which is default-deny.
- PSAK-aware throttling: Replace PersonalApiKeyRateThrottle (which silently bypasses PSAK requests) with PersonalOrProjectSecretApiKeyRateThrottle and ProjectSecretApiKeyTeamRateThrottle.
- Synthetic user handling: Correctly work with ProjectSecretAPIKeyUser, which has no id, always fails has_perm(), and is dropped by report_user_action.
- Use Case: You are adding a programmatic
run action to the endpoints product and need it callable via a phs_ Bearer token with proper scoping, throttling, team binding, and tests.
Quick Start
Ask the agent to add project secret API key authentication to a specific PostHog viewset action, including the scope allowlist entry, throttles, and tests.
