claude-connect

Most of the effort in connecting a subscription-based model to an agent is token mechanics, and this skill targets exactly that: it reads OAuth credentials out of the macOS Keychain, writes them into the agent in the expected profile format, and refreshes them on a two-hour schedule ahead of expiry, reporting success or failure each cycle. That refresh loop is the part worth copying conceptually, since token expiry mid-task is one of the least pleasant failure modes to debug. The narrow fit is that it is macOS-specific and assumes the keychain actually holds usable tokens, so it is a bridge rather than a general auth solution.

Use case: Keeping a subscription-based model connected to an agent on macOS without manual re-authentication.

# One-way token plumbing: run it once, verify the refresh, then leave it alone This skill exists to fix a specific onboarding defect: the initial setup path can fail to write OAuth tokens into the agent's auth profile file, so the agent authenticates nowhere while appearing configured. The skill reads tokens from the system keychain, writes them in the format the agent expects, and refreshes them on a timer. ## Sequence it correctly ```bash claude auth ./install.sh ``` Authenticate with the underlying tool first, then run the installer. Running the installer before there is anything in the keychain produces a configuration with empty values, which looks the same as a working one until the first request. ## Verify the refresh, not just the install The valuable part of this skill is the periodic refresh that runs before expiry. Confirm it actually fires at least once after installation rather than trusting the install message. A refresh loop that died quietly leaves you with a working agent for one token lifetime and a confusing failure afterwards. ## Treat the auth profile as a credential store The file it writes holds live access tokens. Keep its permissions tight and keep it out of any backup that leaves the machine. If the machine is shared, this file is the whole security boundary for the linked subscription. ## Prefer remediation over repetition The underlying defect is in the onboarding path, not in your configuration. If you have hit it once, use this skill rather than re-running onboarding, which can overwrite a working profile with the same broken shape.