SKILL.md
Sent Integration Starter
Bring up a Sent integration in four stages: authenticate, send idempotently, receive verified events, then harden. Do not conflate them — most broken integrations pass stage one and skip stage three.
Stage 1: client and credentials
Direct Sent v3 REST requests authenticate with the x-api-key header. An application proxy may accept Authorization: Bearer from its own callers, and the Sent MCP server uses client-managed OAuth, but neither changes the REST header sent to api.sent.dm. Organization keys may add x-profile-id to act for a child profile; a profile-scoped key that sends that header receives 403.
| Language | Package | Client |
|---|---|---|
| TypeScript | @sentdm/sentdm |
new SentDm({ apiKey }) |
| Python | sentdm (imports sent_dm) |
Sent(api_key=api_key) or AsyncSent(api_key=api_key) |
| Go | github.com/sentdm/sent-dm-go |
sentdm.NewClient(option.WithAPIKey(apiKey)) |
| Java | dm.sent:sent-java |
SentOkHttpClient.builder().apiKey(apiKey).build() |
| C# | Sentdm |
new SentClient { ApiKey = apiKey } |
| PHP | sentdm/sent-dm-php |
new SentDm\Client($apiKey) |
| Ruby | sentdm |
Sentdm::Client.new(api_key: api_key) |
For generated application code, require an explicit, non-empty API key supplied by the application owner and pass it through the SDK's credential option. Inject the signing secret resolved for each webhook id into receiver helpers. Never inspect the plugin installer's environment, credential store, or MCP tokens; the plugin itself authenticates through client-managed OAuth. Multi-tenant production receivers need a secret registry keyed by webhook id.