The Skippr API
Everything the web app does goes through a JSON API, and that API is open to scripts and to AI agents. The OpenAPI specification at /api/openapi.json is generated from the running server’s route table, so it always matches the deployed build.
Authentication
Every endpoint except /api/health, /api/version and /api/auth/* takes `Authorization: Bearer skpr_...`. Create a key under Account -> API keys; the secret is shown once and stored hashed.
What a key may do
A key acts as the sailor who created it, with exactly that sailor’s permissions. Keys cannot change the password, delete the account or manage keys: those need an interactive login.
Conventions
Bodies are JSON. Errors are {"error": "<code>", "message": "<human readable>"} with a 4xx or 5xx status. Timestamps are RFC 3339 UTC, money is integer cents plus an ISO 4217 currency, positions are decimal degrees in WGS 84.
Common questions
- Does Skippr have an API?
- Yes. Everything the web app does goes through a documented JSON API, and an OpenAPI specification is generated from the running server at https://skippr.cc/api/openapi.json. Create a key under Account -> API keys and send it as `Authorization: Bearer skpr_...`.
- What can an API key do?
- A key acts as the sailor who created it and has exactly that sailor’s permissions. Keys deliberately cannot change the password, delete the account or manage other keys: those need an interactive login, so a leaked key can never lock the owner out.