What problem does it solve? Issuing API tokens with the wrong scope is a common security risk: broad Personal Access Tokens expose entire organizations, while read-only Delivery Access Tokens cannot write. This Skill guides the creation of a Weegloo SpaceAccessToken (SPCAT) — a read+write token confined to one Space whose exact power is set entirely by a bound SpaceRole — so agents issue least-privilege credentials instead of over-privileged ones. ## Core Features & Use Cases - Scoped token creation: Issues a SpaceAccessToken via the MCP cma_CreateSpaceAccessToken flow with a deliberately chosen role.sys.id, never defaulting to Administrator or the first listed role. - Token selection guidance: Compares DeliveryAccessToken (read-only CDA), SpaceAccessToken (CMA data + CDA + Upload), and PersonalAccessToken so the least-privileged credential is chosen for each client type. - Anti-escalation guardrails: Handles WGL422001 errors without widening roles, respects WGL429* plan limits, and enforces that the settings axis (webhooks, roles, locales, token issuance) is unreachable regardless of the bound role. - Use Case: A developer building an anonymous public submission board needs a browser-embeddable token that can create content in one ContentType and nothing else. The Skill creates a narrowly scoped SpaceRole, binds it to a new SpaceAccessToken, and reads through the same token instead of exposing a second key. ## Quick Start Ask the agent to create a Weegloo SpaceAccessToken for your Space bound to a least-privilege SpaceRole that only permits the exact content operations your client needs.
