deploy

skills/auth/SKILL.md

@@ -11,6 +11,12 @@ Use the generated operation tools to make real API calls. Do not invent API resp
 If a tool reports missing setup, return the exact setup field name to the caller.
 For write, update, or delete operations, state the intended action before calling the tool.
 
+Deployment auth note:
+
+- Agent calls use required consumer setup secret `LEARNHOUSE_AUTH`.
+- `POST /api/v1/auth/login` accepts `application/x-www-form-urlencoded` credentials and returns `access_token`/`refresh_token` under `tokens`, while also setting `LH_access` and `LH_refresh` cookies.
+- For subsequent API calls, set `LEARNHOUSE_AUTH` to `Bearer <access_token>` or a Cookie header containing `LH_access`/`LH_refresh`.
+
 ## Operations
 
 ### login_api_v1_auth_login_post

skills/courses/SKILL.md

@@ -20,6 +20,7 @@ Deployment context for this LearnHouse instance:
 - When listing courses and the user does not provide pagination, use `page=1` and `limit=50`.
 - When creating a course, use query parameter `org_id=1` unless the user explicitly provides another org ID.
 - Course creation must send multipart form fields `name`, `description`, `public`, and `about`. If the user only gives a title, use it as `name`, provide short `description` and `about` values, and set `public=false` unless the user asks for a public course.
+- Course creation and course management require `LEARNHOUSE_AUTH` consumer setup.
 
 ## Operations