avileo-key-routing
Installation
SKILL.md
Avileo API key routing
Classify the requested operation before choosing a credential. A prefix is not an authorization grant and no key may cross its intended boundary. Require the host environment to inject secrets. Never accept, reveal, store, or transmit a raw key.
Key matrix
| Key | Use it for | Never use it for |
|---|---|---|
avileo_pk_ |
Public storefront/browser SDK reads and approved public flows. | Tenant dashboard actions, catalog-agent writes, inventory, or System Admin. |
avileo_sk_ |
Secret tenant catalog automation for an approved tienda business. |
Browser exposure, another tenant, System Admin, or an operation outside granted actions. |
sak_ |
A separately approved System Admin operator integration. | Tenant catalog CLI, storefront/browser code, or any human-only operation. |
Catalog agent route
For a catalog request, use avileo_sk_ only when the host can inject it as
AVILEO_AGENT_API_KEY. Then delegate the operation to avileo-catalog.