Probabl Authentication

generated: '2026-09-16'
method: searched
source:
- https://api.skore.probabl.ai/openapi.json
- https://github.com/probabl-ai/skore/blob/main/skore/src/skore/_plugins/hub/authentication/apikey.py
- https://github.com/probabl-ai/skore-cli/blob/main/src/skore_cli/_hub_auth.py
- https://github.com/probabl-ai/skore-cli/blob/main/README.md
note: The live Skore Hub OpenAPI (3.1.0) declares NO components.securitySchemes, so derive-authentication.py yields
  nothing. The schemes below come from Probabl's own first-party client code (skore, skore-cli) and the identity
  operations in the spec. An unauthenticated GET /identity/users/me and GET /v1/models both returned 401 {"detail":"Unauthorized"}
  on 2026-09-16.
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
  - deviceCode
  declared_in_openapi: false
schemes:
- name: SkoreHubAPIKey
  type: apiKey
  in: header
  parameter: X-API-Key
  env_var: SKORE_HUB_API_KEY
  description: Workspace-scoped API key. skore sends it as the X-API-Key header when SKORE_HUB_API_KEY is set (non-interactive
    / agent use). Keys are minted by an interactively logged-in user.
  lifecycle_operations:
  - openapi/probabl-identity-api-openapi.yml#create_api_key_identity_users__user_id__api_keys_post
  - openapi/probabl-identity-api-openapi.yml#list_api_keys_identity_users__user_id__api_keys_get
  - openapi/probabl-identity-api-openapi.yml#patch_api_key_identity_users__user_id__api_keys__api_key_id__patch
  - openapi/probabl-identity-api-openapi.yml#delete_api_key_identity_users__user_id__api_keys__api_key_id__delete
  key_fields:
    workspace_id: required
    permissions: required, array of Permission
    expires_at: optional date-time
    name: optional
  permissions:
  - create:project
  - read:project
  - update:project
  - delete:project
  - create:invitation
  - read:invitation
  - delete:invitation
  permissions_source: OpenAPI components.schemas.Permission (API-key permissions, not OAuth scopes)
  used_by:
  - REST API
  - Skore Hub MCP server (https://api.skore.probabl.ai/mcp) via requestHeaders X-API-Key
- name: SkoreHubOAuth
  type: oauth2
  bearer_header: 'Authorization: Bearer <access_token>'
  description: 'Interactive login. The hub brokers an external identity provider (OIDC): /identity/oauth/login returns
    the IdP authorization_url (authorization code flow); /identity/oauth/device/login + /identity/oauth/device/token
    implement a device flow used by the skore Python client and skore-cli. Refresh via /identity/oauth/token/refresh;
    logout revokes tokens at the OAuth2 provider when a revocation endpoint is advertised.'
  flows:
  - flow: authorizationCode
    operations:
    - openapi/probabl-identity-api-openapi.yml#oauth_login_identity_oauth_login_get
    - openapi/probabl-identity-api-openapi.yml#oauth_callback_identity_oauth_callback_get
  - flow: deviceCode
    operations:
    - openapi/probabl-identity-api-openapi.yml#oauth_device_identity_oauth_device_login_get
    - openapi/probabl-identity-api-openapi.yml#oauth_device_token_identity_oauth_device_token_get
  scopes_documented: false
  note: Token responses carry a `scope` string but no scope catalogue is published.
workspace_header:
  name: x-skore-workspace
  in: header
  operations:
  - /v1/chat/completions
  - /v1/responses
  - /v1/messages
roles:
  values:
  - owner
  - contributor
  - reader
  source: OpenAPI components.schemas.WorkspaceRole
docs: https://github.com/probabl-ai/skore-cli#agent