credential-recipe-research

Source excerpt starting at line 1.

1---2name: credential-recipe-research3description: >-4  Lookup procedure for Simplified Custom Auth recipe fields — sources the auth5  template, the key-issuing docsUrl and an auth-rejecting testUrl from the6  provider's real documentation instead of memory. Load before composing7  credentialHints for a service without a dedicated credential type (the8  post-build-flow setup step), or when asked to fix a recipe whose template,9  key page or test endpoint is wrong.10recommended_tools:11  - research12  - workflows13---14 15# Credential Recipe Research16 17A recipe is only as good as the documentation it came from. This is a18procedure, not guidance: execute every step with the `research` tool and keep19only findings you can point to on a fetched page. Guessed URLs are how users20end up on the wrong page with a key that can't be verified.21 22Inputs: the service name and the API host(s) the workflow's nodes call.23 24## 1. Auth scheme (template)25 26Fetch the provider's authentication docs — `research(action="web-search")`27with `"<service> API authentication"`, then `fetch-url` the best docs hit.28Record the scheme EXACTLY as documented: header name, prefix word, casing29(`Authorization: Key {{api_key}}` vs `Bearer {{api_key}}` vs a custom header30like `xi-api-key`). If the documented auth is basic, digest, or OAuth, stop:31that is not expressible as a template — use the matching generic type instead32(see the workflow-builder skill's credential ladder).33 34## 2. Key page (docsUrl)35 36Find where a logged-in user CREATES or COPIES the key. The URL is not shown37in the form — the n8n Assistant help thread presents it as THE place to get38the value, so a wrong URL sends the user to a dead end with full confidence:39 40- Search `"<service> dashboard API keys"`, and scan the fetched auth docs for41  phrases like "get your key from", "Dashboard → API Keys", "console",42  "settings".43- The answer normally lives on an app/console/dashboard host —44  `console.apify.com/settings/integrations`,45  `elevenlabs.io/app/settings/api-keys`, `replicate.com/account/api-tokens`,46  `app.tavily.com/home` — not under `/docs`, `/reference`, or47  `/documentation`.48- Accept a docs-domain URL only when the fetched page shows keys are actually49  issued there (some ReadMe-style logged-in portals do).50- NEVER construct a dashboard path by analogy (`/account/api-keys`,51  `/dashboard/keys`, …). Dashboards are apps behind a login: a fetch answers52  200 for any invented route, so the path cannot be verified by fetching.53  Emit a deep dashboard URL only when it appears VERBATIM on a page you54  fetched; when the docs only describe navigation ("Dashboard → API Keys")55  without a literal URL, use the dashboard/app root they reference — a56  shallower real page beats a deeper invented one.57- Nothing conclusive after both steps → omit docsUrl. Never pass off the API58  reference as the key page.59 60## 3. Verification endpoint (testUrl)61 62Find a documented, side-effect-free GET that rejects a bad key with 401/403.63Check the API reference in this order and stop at the first qualifying hit:64 651. Account/profile/me endpoints — `/v1/account`, `/v2/users/me`, `/v1/user`.662. Usage/quota endpoints — e.g. fal's `/v1/models/usage`, Tavily's `/usage`.673. List/discovery endpoints — `/v1/templates`, `/v1/models`, `/v1/voices`.68 69Rules, all mandatory:70 71- The endpoint must appear on a page you fetched — never construct a path by72  analogy with other APIs.73- Never one of the workflow's own endpoints, never a resource or action URL,74  never anything that can trigger billable work. Setup rejects workflow-URL75  collisions, and the probe reports unexpected statuses as "could not be76  verified" — an invented URL only costs the user trust.77- Skip endpoints that answer 2xx regardless of the key: auth-optional78  endpoints (Pexels search) or services that signal auth errors in the79  response body (Apollo's `auth/health`, TikTok) — a status probe cannot80  verify through them.81- Nothing qualifies → omit testUrl. The credential saves fine and the card82  honestly reports it could not be verified, which beats a false green.83 84## 4. Compose85 86Fill `credentialHints` (field list and example in the post-build-flow skill)87from the findings above only. `suggestedName` names the service ("Apify API88Token"); never include a real secret.89