Institflow ships an [Agent Skill](https://www.anthropic.com/engineering/equipping-agents-for-the-real-world-with-agent-skills) for its own public API — a small, self-contained folder that teaches a coding agent (Claude Code, Cursor, Codex, or anything else that can read a file and make HTTP requests) everything it needs to integrate correctly: authentication, the error envelope, idempotency, pagination, rate limits, webhook signature verification, and working example code — without the agent having to rediscover any of it from trial and error against your tenant.

## The Institflow Agent Skill

The skill is a folder, `institflow-api/`, containing one entry-point file (`SKILL.md`) plus supporting reference material an agent loads only as needed (a full endpoint index generated from the live API spec, webhook/error detail, and two runnable examples — one TypeScript, one Python, both plain `fetch`/stdlib, no SDK). It never encourages an insecure pattern — no keys in query strings, constant-time webhook signature comparison, idempotency keys on every money-moving call.

[Download institflow-api-skill.tar.gz](https://docs.institflow.com/downloads/institflow-api-skill.tar.gz) or [institflow-api-skill.zip](https://docs.institflow.com/downloads/institflow-api-skill.zip) — the same folder, two formats. The tar.gz extracts straight into a skills directory in one command:

```bash
curl -fsSL https://docs.institflow.com/downloads/institflow-api-skill.tar.gz | tar -xz -C ~/.claude/skills
```

That leaves a ready-to-use `~/.claude/skills/institflow-api/` folder — no separate unzip step. Both bundles are rebuilt from this site whenever the API's endpoint set changes, so re-run the command (or re-download the zip) periodically rather than caching your own copy indefinitely.

> **Already working inside this repository?**
>
> Skip the download: this repository checks in a ready-to-use copy at `.claude/skills/institflow-api` (kept byte-identical to `skills/institflow-api/`, the canonical source that ships in the bundles above, by the same generator) — Claude Code loads it automatically, no download or unzip step needed.

## Installing in Claude Code

Claude Code discovers skills from either a personal directory (available in every project) or a per-project one (checked into a repo, shared with your team):

```bash
# Personal — available in every project on this machine
unzip institflow-api-skill.zip -d ~/.claude/skills/institflow-api

# Project — checked into this repo, shared with your team
unzip institflow-api-skill.zip -d .claude/skills/institflow-api
```

Claude Code reads each skill's `SKILL.md` frontmatter (`name` + `description`) to decide when it's relevant — you don't need to reference it by name. Ask it to "create a student via the Institflow API" or "verify this Institflow webhook signature" and it loads the skill automatically.

## Cursor rules

Cursor doesn't yet read the Agent Skills format directly — point it at the same content as a project rule instead: unzip the skill into your repo (anywhere, e.g. `docs/institflow-api/`) and add a short `.cursor/rules/institflow-api.mdc` that references it:

```plaintext
---
description: Institflow public API integration — auth, pagination, idempotency, webhooks
globs:
alwaysApply: false
---

When writing code that calls the Institflow API, follow docs/institflow-api/SKILL.md exactly —
especially its Idempotency, Pagination, and Gotchas sections. Endpoint details are in
docs/institflow-api/reference/endpoints.md.
```

## Other agents

Any agent that can't load a skill folder natively still benefits from the same content: paste `SKILL.md` directly into its system prompt or context window, or point a tool that can fetch a URL at `llms.txt` below, which lists every guide, the machine-readable API spec, and the skill download in one place for exactly this purpose.

```plaintext
https://docs.institflow.com/llms.txt
https://docs.institflow.com/llms-full.txt
```

## Or connect the MCP server directly

If your agent is acting on behalf of a specific signed-in person (not running unattended as a service) and speaks the Model Context Protocol, connecting to `/mcp` is often a better fit than the REST API this skill covers — OAuth consent scopes the session to exactly that person's own permissions, and destructive actions come back as a confirmation preview instead of executing immediately. See the [MCP & OAuth 2.1 guide](https://docs.institflow.com/en/mcp) for the connect URL, the discovery flow, and the full tool catalogue, and this skill's own "REST vs. MCP" section for which one to reach for.

> **Both surfaces, one permission model**
>
> REST (with an API key) and MCP (with an OAuth token) call the exact same domain services under the exact same permission registry — nothing is possible through one that isn't governed by the same rules through the other.