Agent setup
The Markdown block a repo splices into AGENTS.md, and how to ask for a service Squiid does not carry yet.
GET /v1/me/instructions returns a Markdown block, wrapped in <!-- squiid:begin --> and <!-- squiid:end -->, that an agent splices into AGENTS.md so every later run knows which services this key reaches. x-sq-instructions-hash is the sha256 of the body, so a rewrite is skipped when nothing changed. If Squiid does not carry a service yet, POST /v1/service-requests asks for it and answers whether we already know the name.
Both endpoints
# The Markdown block to splice into AGENTS.md / CLAUDE.md.
# Between <!-- squiid:begin --> and <!-- squiid:end -->, so a later run replaces it.
curl https://api.squiid.io/v1/me/instructions \
-H "Authorization: Bearer $SQUIID_API_KEY"
# 200 text/markdown, x-sq-instructions-hash: <sha256 of the body>
# Squiid does not carry it yet? Ask for it.
curl -X POST https://api.squiid.io/v1/service-requests \
-H "Authorization: Bearer $SQUIID_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "service": "clerk", "note": "auth for the console" }'
# 201 { "id": "srq_…", "service": "clerk", "known": true, "status": "received" }const res = await fetch("https://api.squiid.io/v1/me/instructions", {
headers: { Authorization: `Bearer ${process.env.SQUIID_API_KEY}` },
});
const block = await res.text(); // between <!-- squiid:begin --> and <!-- squiid:end -->
const hash = res.headers.get("x-sq-instructions-hash"); // skip the rewrite when unchanged
await fetch("https://api.squiid.io/v1/service-requests", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.SQUIID_API_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({ service: "clerk", note: "auth for the console" }),
});import httpx, os
KEY = os.environ["SQUIID_API_KEY"]
auth = {"Authorization": f"Bearer {KEY}"}
res = httpx.get("https://api.squiid.io/v1/me/instructions", headers=auth)
block = res.text # splice between the squiid:begin/end markers
hash_ = res.headers["x-sq-instructions-hash"]
httpx.post(
"https://api.squiid.io/v1/service-requests",
headers=auth,
json={"service": "clerk", "note": "auth for the console"},
)Or write the block yourself
The endpoint saves an agent from guessing, but the convention is four lines and you can paste them by hand:
# Services
All third-party calls go through the Squiid gateway.
Base URL: https://api.squiid.io/v1/<service>/
Header: Authorization: Bearer $SQUIID_API_KEY
Never add provider-specific API keys to this repo.That block works in CLAUDE.md for Claude Code, AGENTS.md for Codex, .cursor/rules for Cursor, .windsurf/rules/ for Windsurf, .clinerules for Cline, GEMINI.md for Gemini CLI and .github/copilot-instructions.md for GitHub Copilot.
Per-agent pages
The exact config file, the exact flag and the convention to put in your project rules, agent by agent:
What an agent key can and cannot do
- It calls the services its scope allows, up to its spend cap and rate limit.
- It never creates another key, and never raises its own cap.
- It never signs up for an account, with Squiid or with a provider.
- It never tops up the wallet or moves money.
That split — the agent proposes, a human approves — is the whole security model, and it works because the policy rides on the key and the gateway enforces it before the request leaves.
Teach the repo once.
One block in your rules file and every later run knows which services the key reaches.