Forge prompts from your own code
Everything this app does goes through the SkillSafe App API — plain JSON over HTTPS, so you can script it from any language. This page walks through each task with examples in cURL, Python, JavaScript, Go, Java, Ruby, PHP and C#.
Basics
Base URL: https://api.skillsafe.ai/v1/app-api. Every request sends
Authorization: Bearer <token> and JSON bodies with
Content-Type: application/json. Responses are wrapped in an envelope:
{"data": …} on success, {"error": {"code", "message"}} on failure.
| Status | Meaning |
|---|---|
401 | Missing or expired token — create a new session. |
402 | Not enough credits — top up at skillsafe.ai/account/credits. |
403 | The token isn't allowed to do this (e.g. guests running a custom forge). |
404 | Unknown job or record id. |
5xx | Transient platform error — retry with backoff. |
Browsers enforce CORS for this API, so run these examples from a server, script or terminal — not from another website's frontend.
Step 0 — A tiny client
Every task below is a single HTTP call, so start with a 15-line helper that adds the
auth header, sends JSON and unwraps the data envelope. The later steps
reuse this helper.
export API="https://api.skillsafe.ai/v1/app-api"
export TOKEN="YOUR_TOKEN" # see step 1
# every call looks like:
# curl -s "$API/…" -H "Authorization: Bearer $TOKEN" [-d '{json}']
# jq is used below to pull fields out of the {"data": …} envelope
import json, requests
API = "https://api.skillsafe.ai/v1/app-api"
TOKEN = "YOUR_TOKEN" # see step 1
def api(method, path, body=None, **headers):
res = requests.request(method, API + path, json=body,
headers={"Authorization": f"Bearer {TOKEN}", **headers})
payload = res.json()
if not res.ok:
raise RuntimeError(payload.get("error", {}).get("message", res.reason))
return payload["data"]
// Node 18+ (built-in fetch)
const API = "https://api.skillsafe.ai/v1/app-api";
const TOKEN = "YOUR_TOKEN"; // see step 1 — read it from your environment in real code
async function api(method, path, body, extraHeaders = {}) {
const res = await fetch(API + path, {
method,
headers: { Authorization: `Bearer ${TOKEN}`, "Content-Type": "application/json", ...extraHeaders },
body: body === undefined ? undefined : JSON.stringify(body),
});
const json = await res.json();
if (!res.ok) throw new Error(json.error?.message ?? res.statusText);
return json.data;
}
package main
import (
"bytes"
"encoding/json"
"fmt"
"net/http"
"os"
)
const API = "https://api.skillsafe.ai/v1/app-api"
var token = os.Getenv("SKILLSAFE_TOKEN") // see step 1
func call(method, path string, body, out any) error {
var buf bytes.Buffer
if body != nil {
json.NewEncoder(&buf).Encode(body)
}
req, _ := http.NewRequest(method, API+path, &buf)
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)
if err != nil {
return err
}
defer res.Body.Close()
var env struct {
Data json.RawMessage `json:"data"`
Error *struct{ Message string `json:"message"` } `json:"error"`
}
json.NewDecoder(res.Body).Decode(&env)
if res.StatusCode >= 400 {
return fmt.Errorf("api %s %s: %s", method, path, env.Error.Message)
}
if out == nil {
return nil
}
return json.Unmarshal(env.Data, out)
}
// Java 17+, no dependencies. Pair with your JSON library (Jackson, Gson…)
// to read fields out of the returned envelope.
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class SkillSafe {
static final String API = "https://api.skillsafe.ai/v1/app-api";
static final String TOKEN = System.getenv("SKILLSAFE_TOKEN"); // see step 1
static final HttpClient HTTP = HttpClient.newHttpClient();
static String api(String method, String path, String jsonBody) throws Exception {
var req = HttpRequest.newBuilder(URI.create(API + path))
.header("Authorization", "Bearer " + TOKEN)
.header("Content-Type", "application/json")
.method(method, jsonBody == null
? HttpRequest.BodyPublishers.noBody()
: HttpRequest.BodyPublishers.ofString(jsonBody))
.build();
var res = HTTP.send(req, HttpResponse.BodyHandlers.ofString());
if (res.statusCode() >= 400) throw new RuntimeException(res.body());
return res.body(); // envelope: {"data": …}
}
}
require "net/http"
require "json"
API = "https://api.skillsafe.ai/v1/app-api"
TOKEN = ENV.fetch("SKILLSAFE_TOKEN") # see step 1
def api(method, path, body = nil)
uri = URI(API + path)
req = Net::HTTP.const_get(method.capitalize).new(uri)
req["Authorization"] = "Bearer #{TOKEN}"
req["Content-Type"] = "application/json"
req.body = body.to_json if body
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
payload = JSON.parse(res.body)
raise (payload.dig("error", "message") || res.message) unless res.is_a?(Net::HTTPSuccess)
payload["data"]
end
<?php
const API = "https://api.skillsafe.ai/v1/app-api";
$TOKEN = getenv("SKILLSAFE_TOKEN"); // see step 1
function api(string $method, string $path, ?array $body = null): mixed {
global $TOKEN;
$ch = curl_init(API . $path);
curl_setopt_array($ch, [
CURLOPT_CUSTOMREQUEST => $method,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
"Authorization: Bearer $TOKEN",
"Content-Type: application/json",
],
CURLOPT_POSTFIELDS => $body === null ? null : json_encode($body),
]);
$payload = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);
if ($status >= 400) {
throw new Exception($payload["error"]["message"] ?? "HTTP $status");
}
return $payload["data"];
}
// .NET 8+
using System.Net.Http.Json;
using System.Text.Json;
static class SkillSafe
{
const string Api = "https://api.skillsafe.ai/v1/app-api";
static readonly HttpClient Http = new();
static SkillSafe() =>
Http.DefaultRequestHeaders.Authorization =
new("Bearer", Environment.GetEnvironmentVariable("SKILLSAFE_TOKEN")); // see step 1
public static async Task<JsonElement> ApiAsync(HttpMethod method, string path, object? body = null)
{
var req = new HttpRequestMessage(method, Api + path);
if (body != null) req.Content = JsonContent.Create(body);
var res = await Http.SendAsync(req);
var json = await res.Content.ReadFromJsonAsync<JsonElement>();
if (!res.IsSuccessStatusCode)
throw new Exception(json.GetProperty("error").GetProperty("message").GetString());
return json.GetProperty("data");
}
}
Step 1 — Get a token
A guest token lets you check balances, estimate costs and run the built-in example
(free). To forge your own prompts you need your personal token: open the
token page, sign in, and hit
"Copy shell export" — it puts export SKILLSAFE_TOKEN="…" on your clipboard,
which every example below reads. Treat the token like a password — it can spend your
credits. For fully headless scripts, POST /guest (below) mints a guest token
with no browser involved.
curl -s -X POST "$API/guest" \
-H "Content-Type: application/json" \
-d '{"slug":"prompt-forge"}' | jq -r '.data.token'
token = api("POST", "/guest", {"slug": "prompt-forge"})["token"]
const { token } = await api("POST", "/guest", { slug: "prompt-forge" });
var guest struct{ Token string `json:"token"` }
err := call("POST", "/guest", map[string]string{"slug": "prompt-forge"}, &guest)
String envelope = api("POST", "/guest", """
{"slug":"prompt-forge"}""");
// token is at data.token in the returned JSON
token = api("POST", "/guest", { slug: "prompt-forge" })["token"]
$token = api("POST", "/guest", ["slug" => "prompt-forge"])["token"];
var guest = await SkillSafe.ApiAsync(HttpMethod.Post, "/guest",
new { slug = "prompt-forge" });
var token = guest.GetProperty("token").GetString();
Step 2 — Check who you are and your balance
Returns subject_type ("user" or "guest"),
subject_id and your credits balance. Check this before an
expensive run.
curl -s "$API/me" -H "Authorization: Bearer $TOKEN" | jq '.data'
me = api("GET", "/me")
print(me["subject_type"], me["credits"])
const me = await api("GET", "/me");
console.log(me.subject_type, me.credits);
var me struct {
SubjectType string `json:"subject_type"`
Credits int64 `json:"credits"`
}
err := call("GET", "/me", nil, &me)
String envelope = api("GET", "/me", null);
// data.subject_type, data.credits
me = api("GET", "/me")
puts "#{me["subject_type"]}: #{me["credits"]} credits"
$me = api("GET", "/me");
echo "{$me['subject_type']}: {$me['credits']} credits\n";
var me = await SkillSafe.ApiAsync(HttpMethod.Get, "/me");
Console.WriteLine($"{me.GetProperty("subject_type")}: {me.GetProperty("credits")} credits");
Step 3 — Estimate the cost
Send the same input you would send to /run; the response's
hold_credits is the worst-case cost. Nothing is charged and no job is created.
| Input field | Type | Notes |
|---|---|---|
raw_prompt | string, required | The rough prompt to optimize, verbatim. |
task_hint | string, optional | auto (default) or one of coding, writing, analysis, design, planning, communication, learning, decision-making, creative, goal-setting, coaching. |
audience | string, optional | Who will read the AI's eventual answer. |
output_format_wanted | string, optional | The format the final answer should take (table, design doc, email…). |
prescan | object, optional | Client-side lint facts the web app sends: {chars, words, guessed_complexity, guessed_type, has_role, has_format, has_constraints, vague_verbs}. Omit it in scripts — the model re-derives these. Both guessed_* fields are keyword-matching guesses treated as weak evidence: an explicit task_hint and the model's own reading both outrank them. |
curl -s -X POST "$API/estimate" \
-H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
-d '{"raw_prompt":"help me write a launch email for our new API","task_hint":"auto"}' \
| jq '.data.hold_credits'
est = api("POST", "/estimate", {
"raw_prompt": raw_prompt, "task_hint": "auto",
})
print("worst case:", est.get("hold_credits", est.get("credits")), "credits")
const est = await api("POST", "/estimate", {
raw_prompt: rawPrompt, task_hint: "auto",
});
console.log("worst case:", est.hold_credits ?? est.credits, "credits");
var est struct{ HoldCredits int64 `json:"hold_credits"` }
err := call("POST", "/estimate", map[string]string{
"raw_prompt": rawPrompt, "task_hint": "auto",
}, &est)
String envelope = api("POST", "/estimate", """
{"raw_prompt": %s, "task_hint": "auto"}
""".formatted(toJsonString(rawPrompt)));
// worst-case cost is at data.hold_credits
est = api("POST", "/estimate", { raw_prompt: raw_prompt, task_hint: "auto" })
puts "worst case: #{est["hold_credits"] || est["credits"]} credits"
$est = api("POST", "/estimate", [
"raw_prompt" => $rawPrompt,
"task_hint" => "auto",
]);
echo "worst case: " . ($est["hold_credits"] ?? $est["credits"]) . " credits\n";
var est = await SkillSafe.ApiAsync(HttpMethod.Post, "/estimate", new {
raw_prompt = rawPrompt, task_hint = "auto" });
Console.WriteLine($"worst case: {est.GetProperty("hold_credits")} credits");
Step 4 — Run a forge and wait for the result
/run takes the same input as /estimate, places a credit hold and
returns a job_id. Poll /jobs/{job_id} every 1–2 seconds until
status is succeeded or failed (a run typically takes
20–60 s). Always send an Idempotency-Key header so a network retry can't
start a second, double-charged run. The report is in output (sometimes nested
as output.output, and possibly a JSON string — parse defensively).
JOB_ID=$(curl -s -X POST "$API/run" \
-H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
-H "Idempotency-Key: run-$(date +%s)" \
-d @input.json | jq -r '.data.job_id')
while :; do
JOB=$(curl -s "$API/jobs/$JOB_ID" -H "Authorization: Bearer $TOKEN")
STATUS=$(echo "$JOB" | jq -r '.data.status')
[ "$STATUS" = "succeeded" ] || [ "$STATUS" = "failed" ] && break
sleep 2
done
echo "$JOB" | jq '.data.output'
import time
job_id = api("POST", "/run", {
"raw_prompt": raw_prompt, "task_hint": "auto",
}, **{"Idempotency-Key": "my-run-001"})["job_id"]
while True:
job = api("GET", f"/jobs/{job_id}")
if job["status"] in ("succeeded", "failed"):
break
time.sleep(1.5)
if job["status"] == "failed":
raise RuntimeError(job.get("error", "run failed"))
raw = job["output"]
if isinstance(raw, dict) and "output" in raw:
raw = raw["output"]
report = json.loads(raw) if isinstance(raw, str) else raw
print(report["verdict"])
print(report["optimized_prompt"])
const { job_id } = await api("POST", "/run", {
raw_prompt: rawPrompt, task_hint: "auto",
}, { "Idempotency-Key": crypto.randomUUID() });
let job;
do {
await new Promise((r) => setTimeout(r, 1500));
job = await api("GET", `/jobs/${job_id}`);
} while (job.status !== "succeeded" && job.status !== "failed");
if (job.status === "failed") throw new Error(job.error ?? "run failed");
const raw = job.output?.output ?? job.output;
const report = typeof raw === "string" ? JSON.parse(raw) : raw;
console.log(report.verdict);
console.log(report.optimized_prompt);
var started struct{ JobID string `json:"job_id"` }
err := call("POST", "/run", map[string]string{
"raw_prompt": rawPrompt, "task_hint": "auto",
}, &started)
if err != nil {
log.Fatal(err)
}
var job struct {
Status string `json:"status"`
Error string `json:"error"`
Output json.RawMessage `json:"output"`
}
for {
if err := call("GET", "/jobs/"+started.JobID, nil, &job); err != nil {
log.Fatal(err)
}
if job.Status == "succeeded" || job.Status == "failed" {
break
}
time.Sleep(1500 * time.Millisecond)
}
// job.Output holds the report (may be {"output": …} or a JSON string —
// unwrap/unquote before unmarshalling into your report struct).
String envelope = api("POST", "/run", """
{"raw_prompt": %s, "task_hint": "auto"}
""".formatted(toJsonString(rawPrompt)));
String jobId = /* data.job_id via your JSON library */;
while (true) {
String job = api("GET", "/jobs/" + jobId, null);
String status = /* data.status */;
if (status.equals("succeeded") || status.equals("failed")) break;
Thread.sleep(1500);
}
// the report is at data.output (sometimes data.output.output, possibly a
// JSON string — parse it again if so)
started = api("POST", "/run", { raw_prompt: raw_prompt, task_hint: "auto" })
job = nil
loop do
job = api("GET", "/jobs/#{started["job_id"]}")
break if %w[succeeded failed].include?(job["status"])
sleep 1.5
end
raise (job["error"] || "run failed") if job["status"] == "failed"
raw = job["output"].is_a?(Hash) ? job["output"].fetch("output", job["output"]) : job["output"]
report = raw.is_a?(String) ? JSON.parse(raw) : raw
puts report["verdict"]
puts report["optimized_prompt"]
$started = api("POST", "/run", [
"raw_prompt" => $rawPrompt,
"task_hint" => "auto",
]);
do {
sleep(2);
$job = api("GET", "/jobs/" . $started["job_id"]);
} while (!in_array($job["status"], ["succeeded", "failed"]));
if ($job["status"] === "failed") {
throw new Exception($job["error"] ?? "run failed");
}
$raw = is_array($job["output"]) ? ($job["output"]["output"] ?? $job["output"]) : $job["output"];
$report = is_string($raw) ? json_decode($raw, true) : $raw;
echo $report['verdict'] . "\n" . $report['optimized_prompt'] . "\n";
var started = await SkillSafe.ApiAsync(HttpMethod.Post, "/run", new {
raw_prompt = rawPrompt, task_hint = "auto" });
var jobId = started.GetProperty("job_id").GetString();
JsonElement job;
while (true)
{
job = await SkillSafe.ApiAsync(HttpMethod.Get, $"/jobs/{jobId}");
var status = job.GetProperty("status").GetString();
if (status is "succeeded" or "failed") break;
await Task.Delay(1500);
}
// the report is at job.GetProperty("output") — sometimes nested under
// "output", possibly a JSON string; parse defensively.
The result object has this shape:
| Field | Type |
|---|---|
task_type | string — inferred task label |
complexity | Simple | Moderate | Complex |
clarity | Clear | Ambiguous |
verdict | Ready | Needs clarification |
frameworks | array of {name, reason} — 1–3 of RTF, RISEN, Chain of Thought, RODES, Chain of Density, RACE, RISE, STAR, SOAP, CLEAR, GROW |
optimized_prompt | string — the paste-ready prompt; [square-bracket] placeholders mark details only you can fill in |
clarifying_questions | string[] — at most 3; empty when verdict is Ready |
improvements | array of {gap, fix} |
quality_checks | object of booleans: self_contained, specific_task, output_format, unambiguous, right_sized |
notes | string — 2–3 sentence summary of what changed |
Step 5 — Stream the forge live (SSE)
Same input and billing as /run, but the response is a Server-Sent-Events
stream: job (accepted), repeated delta events carrying output
text as it is generated, then a final done event whose payload matches the
finished job (its output is authoritative — the app itself uses this
endpoint). Send an Idempotency-Key here too.
curl -N -s -X POST "$API/run-stream" \
-H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
-H "Accept: text/event-stream" -H "Idempotency-Key: forge-$(date +%s)" \
-d '{"raw_prompt":"help me write a launch email for our new API"}'
# events arrive as: event: delta\ndata: {"text":"…"}
import requests, json
with requests.post(f"{API}/run-stream",
headers={"Authorization": f"Bearer {TOKEN}", "Accept": "text/event-stream",
"Idempotency-Key": "forge-001"},
json={"raw_prompt": raw_prompt}, stream=True) as res:
for line in res.iter_lines(decode_unicode=True):
if line.startswith("data:"):
evt = json.loads(line[5:])
if "text" in evt:
print(evt["text"], end="", flush=True)
const res = await fetch(`${API}/run-stream`, {
method: "POST",
headers: { Authorization: `Bearer ${TOKEN}`, "Content-Type": "application/json",
Accept: "text/event-stream", "Idempotency-Key": crypto.randomUUID() },
body: JSON.stringify({ raw_prompt: rawPrompt }),
});
const reader = res.body.pipeThrough(new TextDecoderStream()).getReader();
for (;;) {
const { done, value } = await reader.read();
if (done) break;
for (const line of value.split("\n"))
if (line.startsWith("data:")) process.stdout.write(JSON.parse(line.slice(5)).text ?? "");
}
req, _ := http.NewRequest("POST", API+"/run-stream",
strings.NewReader(`{"raw_prompt":"help me write a launch email"}`))
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Accept", "text/event-stream")
res, err := http.DefaultClient.Do(req)
if err != nil { log.Fatal(err) }
defer res.Body.Close()
sc := bufio.NewScanner(res.Body)
for sc.Scan() {
line := sc.Text()
if strings.HasPrefix(line, "data:") {
fmt.Print(line[5:]) // parse JSON for the "text" field in real code
}
}
// Java 17+: read the SSE body line by line
var req = HttpRequest.newBuilder(URI.create(API + "/run-stream"))
.header("Authorization", "Bearer " + TOKEN)
.header("Content-Type", "application/json")
.header("Accept", "text/event-stream")
.POST(HttpRequest.BodyPublishers.ofString(
"{\"raw_prompt\":\"help me write a launch email\"}"))
.build();
HTTP.send(req, HttpResponse.BodyHandlers.ofLines())
.body()
.filter(l -> l.startsWith("data:"))
.forEach(l -> System.out.println(l.substring(5)));
uri = URI("#{API}/run-stream")
req = Net::HTTP::Post.new(uri)
req["Authorization"] = "Bearer #{TOKEN}"
req["Content-Type"] = "application/json"
req["Accept"] = "text/event-stream"
req.body = { raw_prompt: raw_prompt }.to_json
Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
http.request(req) do |res|
res.read_body do |chunk|
chunk.each_line { |l| print l[5..] if l.start_with?("data:") }
end
end
end
$ch = curl_init(API . "/run-stream");
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_HTTPHEADER => ["Authorization: Bearer $TOKEN",
"Content-Type: application/json",
"Accept: text/event-stream"],
CURLOPT_POSTFIELDS => json_encode(["raw_prompt" => $rawPrompt]),
CURLOPT_WRITEFUNCTION => function ($ch, $chunk) {
foreach (explode("\n", $chunk) as $line) {
if (str_starts_with($line, "data:")) echo substr($line, 5);
}
return strlen($chunk);
},
]);
curl_exec($ch);
curl_close($ch);
var req = new HttpRequestMessage(HttpMethod.Post, Api + "/run-stream")
{
Content = JsonContent.Create(new { raw_prompt = rawPrompt })
};
req.Headers.Accept.ParseAdd("text/event-stream");
var res = await Http.SendAsync(req, HttpCompletionOption.ResponseHeadersRead);
using var reader = new StreamReader(await res.Content.ReadAsStreamAsync());
while (await reader.ReadLineAsync() is { } line)
if (line.StartsWith("data:")) Console.Write(line[5..]);
The web app saves your forge history in this browser only — there is no server-side
collection to query. Keep the done event's payload if you want a record.