Integrate third-party Bots with token authentication and HMAC-signed webhook delivery.
npx skills add https://github.com/hellopoisonx/aim --skill aim-bot-domain
Please help me install this Agent Skill. Skill: aim-bot-domain Source: https://github.com/hellopoisonx/aim/tree/main/skills/aim-bot-domain Command: npx skills add https://github.com/hellopoisonx/aim --skill aim-bot-domain
It standardizes how third-party Bots authenticate, authorize action permissions, and receive verified webhook deliveries in AIM, reducing integration drift and operational risk.
bot_actions, bot_token_permissions, and bot_event_actions so Bots can only call what they’re allowed to do.message.created events, signs deliveries (HMAC), and handles retries with backoff to prevent callback loops and protect the archive pipeline.Provision a Bot by running the operator script scripts/bot-provision/provision_bot.sh, then share the plaintext token with the Bot developer for Authorization: Bot <token> calls to /api/bot/v1/*.
High-intent search queries and answers about installing and using this skill.
Third-party bots authenticate with REST APIs using provisioned tokens via the Authorization header. Token hashes are stored using SHA-256, enabling reliable access control with expiration, revocation, and enabled status checks for secure bot authentication.
Bot provisioning is done by running an operator script that creates bot users, memberships, and issues tokens. The script outputs a plaintext token to share with developers for making authorized calls to the bot REST endpoints.
Webhook delivery for message created events uses an isolated Kafka consumer group to subscribe to events. Deliveries are signed with HMAC signatures and include retry logic with backoff to prevent callback loops and protect the archive pipeline.
Action-based authorization enforces scoped permissions using bot actions, token permissions, and event actions. This ensures bots can only call approved endpoints by validating action checks through a dedicated bot service RPC.
Yes, webhook consumers use an isolated Kafka consumer group with retryable HMAC-signed dispatch. The backoff retry mechanism prevents callback loops and protects downstream archive pipelines during message created event delivery.
The best way to secure webhook deliveries is using HMAC-signed payloads processed by an isolated Kafka consumer group. This approach verifies delivery authenticity and uses retry backoff to safely manage message created events.
ClawStackStudiosAuthenticate ClawChives users by validating identity files and exchanging SHA-256 hashes.
cosmixImplement signed webhook endpoints with HMAC verification and retry handling.
vecearImplement role-based access control with permission matrices and route guards.
gocallumAutomate Clerk authentication setup for Next.js 16 App Router projects.