capgo-organization-management
Guides Capgo account lookup and organization administration with the CLI, including account whoami, organization list/add/members/set/delete, 2FA enforcement, password policy, API-key expiration and hashed-key policy, and apps per organization. Use when listing or creating Capgo organizations, auditing members' 2FA before enforcing it, tightening org security settings, or resolving "Access Denied: Two-Factor Authentication Required" or "Insufficient permissions". Do not use for OTA bundle or channel work (capgo-release-management), native builds (capgo-native-builds), or app-side updater code (capgo-live-updates).
- Installs
- 688
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/cap-go/capgo-skills --skill capgo-organization-management- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads capgo-organization-management automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Capgo Organization Management
Administer Capgo accounts and organizations safely from the CLI.
Facts below were checked against @capgo/cli 8.77 (October 2026). All commands accept -a, --apikey.
When to Use
TRIGGER when:
- The user needs their Capgo account ID or email for support (
account whoami). - The user lists, creates, renames, or deletes organizations.
- The user audits members or 2FA status, or enforces 2FA, a password policy, API-key expiration, or hashed API keys.
- The user needs to know which org owns an app (
app list --show-org --show-org-id). - A command fails with an org-level 2FA or permission error.
Do not use when:
- The work is bundles, channels, or rollouts. Use
capgo-release-management. - The user needs native cloud builds. Use
capgo-native-builds. - The user wants an agent connected to the Capgo account (MCP). Use
capgo-cli-usage.
Command Map
| Goal | Command (npx @capgo/cli@latest ...) |
|---|---|
| Who am I | account whoami (alias account id) |
| List orgs | organization list |
| Create org | organization add --name "My Company" --email admin@example.com |
| Members + 2FA status | organization members ORG_ID (2FA status needs super_admin) |
| Rename / change email | organization set ORG_ID --name "New Name" --email ops@example.com |
| Enforce 2FA | organization set ORG_ID --enforce-2fa (--no-enforce-2fa to undo) |
| Password policy | organization set ORG_ID --password-policy --min-length 12 --require-uppercase --require-number --require-special |
| API-key expiration | organization set ORG_ID --require-apikey-expiration --max-apikey-expiration-days 90 (1 to 365) |
| Hashed API keys | organization set ORG_ID --enforce-hashed-api-keys |
| Apps per org | app list --show-org --show-org-id or app list --filter-by-org-id ORG_ID --output-text |
| Delete org | organization delete ORG_ID (owner only, irreversible) |
Use organization. The organisation spelling is deprecated and will be removed.
Procedure
1. Identify scope and role
npx @capgo/cli@latest account whoami
npx @capgo/cli@latest organization list
Confirm the target ORG_ID. Security settings need the super_admin role. Deleting an org needs the owner.
2. Inspect before enforcing
npx @capgo/cli@latest organization members ORG_ID
List the members without 2FA, then report to the user before enforcing. Enforcing 2FA locks those members out of CLI and API access until they enable it.
3. Change one policy at a time
Apply one organization set change, verify it, then move to the next. Keep at least one admin with working 2FA and a valid key so the org is never locked out.
4. API-key policy side effects
--require-apikey-expiration/--max-apikey-expiration-daysaffects new keys. The keys the hosted MCP creates for OAuth (MCP · <client>) already expire after at most 90 days, and a stricter org limit wins.--enforce-hashed-api-keysmeans a key is shown only once at creation. Existing CI secrets keep working, but a lost key must be recreated.
Traps
organization deletecannot be undone, and only owners can run it. Runapp list --filter-by-org-id ORG_IDfirst so the user sees what lives in that org, then get explicit confirmation with the org name.organization membersneedssuper_adminto show 2FA status. Lower roles see partial data.- Do not ask users to paste API keys into chat for admin work. Have them run
npx @capgo/cli@latest login, or setCAPGO_TOKENin their shell.
Verification
- Run
organization listagain. The name and email changes show up. - Run
organization members ORG_IDagain after enforcement. Every remaining member shows 2FA enabled. - Run a read-only command with a non-admin member's key (for example
app list). It should succeed after they enable 2FA.
Error Handling
| String | Fix |
|---|---|
🔐 Access Denied: Two-Factor Authentication Required / This organization requires all members to have 2FA enabled. | Enable 2FA at https://console.capgo.app (account settings), then retry. Docs: https://capgo.app/docs/webapp/2fa-enforcement/ |
Insufficient permissions for <key> | The acting user or key lacks the role. Security settings need super_admin, delete needs the owner |
No organizations available | The key's user has no org yet. Create one with organization add |
No Capgo API key found. Run ... first, then retry this command. | npx @capgo/cli@latest login, set CAPGO_TOKEN, or pass -a |
Resources
- Organization reference: https://capgo.app/docs/cli/reference/organization/
- Account reference: https://capgo.app/docs/cli/reference/account/
- 2FA enforcement: https://capgo.app/docs/webapp/2fa-enforcement/
FAQ
What does the capgo-organization-management skill do?
Guides Capgo account lookup and organization administration with the CLI, including account whoami, organization list/add/members/set/delete, 2FA enforcement, password policy, API-key expiration and hashed-key policy, and apps per organization. Use when listing or creating Capgo organizations, auditing members' 2FA before enforcing it, tightening org security settings, or resolving "Access Denied: Two-Factor Authentication Required" or "Insufficient permissions". Do not use for OTA bundle or channel work (capgo-release-management), native builds (capgo-native-builds), or app-side updater code (capgo-live-updates).
How do I install capgo-organization-management?
Run npx skills add https://github.com/cap-go/capgo-skills --skill capgo-organization-management in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/capgo-organization-management/ (personal) or .claude/skills/capgo-organization-management/ (project).
Which AI agents can use capgo-organization-management?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is capgo-organization-management safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains capgo-organization-management?
It is published by cap-go in cap-go/capgo-skills. It has 688 recorded installs.
More from cap-go/capgo-skills
capacitor-best-practices
cap-go/capgo-skills
Review and set up Capacitor apps against current best practices (Capacitor 8.5 stable, 9 alpha via @next). Use for a Capacitor codebase review, capacitor.config.ts audit, new project setup, aligning @capacitor/core/cli/ios/android and plugin majors, plugin patterns (availability checks, checkPermissions/requestPermissions, error code handling, web fallbacks), or release prep; or on " " plugin is not implemented on ios, Could not find the web assets directory, platform has not been added yet, a dev server.url shipped to production, lost edits in android/app/src/main/assets/public, SPM vs CocoaPods, or AppDelegate/UIScene drift. Do not use for security audits (capacitor-security), performance (capacitor-performance), tests (capacitor-testing), crashes (debugging-capacitor), major upgrades (capacitor-app-upgrades), SPM migration (cocoapods-to-spm), UIScene adoption (capacitor-uiscene-migration), or live updates (capgo-live-updates).
ionic-design
cap-go/capgo-skills
Builds and reviews Ionic Framework UI in Capacitor apps (Ionic 9 current, Ionic 8 still common) - page structure (ion-header/ion-content/ion-footer), lists, modern form syntax (label/labelPlacement on ion-input/ion-select), sheet modals, tabs + ion-router-outlet, CSS variable theming, dark palettes (palettes/dark.system.css, .ion-palette-dark), iOS vs MD mode, and Ionic 8 - 9 breaking changes (React Router 6, Vue Router 5, Angular 18-22 zoneless, removed ion-picker-legacy, boolean autocorrect, npx @ionic/migrate). Use when writing Ionic components, theming an Ionic app, fixing platform-mode styling, or upgrading @ionic/react, @ionic/vue, @ionic/angular. Do not use for Konsta UI (konsta-ui), Tailwind setup (tailwind-capacitor), raw safe-area CSS (safe-area-handling), keyboard resize (capacitor-keyboard), or Ionic Appflow/Enterprise migrations (ionic-appflow-migration, ionic-enterprise-sdk-migration).
capacitor-plugins
cap-go/capgo-skills
Pick, install, and wire up Capacitor plugins for native features (camera, filesystem, geolocation, biometrics, in-app purchases, social login, SQLite, calendar, contacts, health, BLE, NFC, etc.). Covers official @capacitor/ packages (Capacitor 8.5 stable, 9 alpha on next) plus the 145-package @capgo/ index, native permission keys (Info.plist, AndroidManifest, variables.gradle minSdk), npx cap sync / cap ls verification, and errors like '"Camera" plugin is not implemented on ios', 'unable to find plugin', UNIMPLEMENTED, and OS-PLUG- codes. Use for "which plugin should I use for X", adding a plugin, or a plugin call failing after install. Do not use for push setup (capacitor-push-notifications), splash assets (capacitor-splash-screen), keyboard layout (capacitor-keyboard), deep links (capacitor-deep-linking), OTA updates (capgo-live-updates), upgrading plugin source code (capacitor-plugin-upgrades), or adding SPM to a plugin (capacitor-plugin-spm-support).
debugging-capacitor
cap-go/capgo-skills
Diagnoses and fixes runtime bugs in Capacitor iOS/Android apps - white/blank screen on launch, startup crashes, "X" plugin is not implemented on ios/android, net::ERRCLEARTEXTNOTPERMITTED, App Transport Security blocks, CORS on capacitor://localhost, permission denials, live reload not connecting, and Capacitor 8.5+ UIScene regressions (appUrlOpen, universal links, pause/resume silent because AppDelegate callbacks stopped). Covers Safari Web Inspector, chrome://inspect, Xcode/LLDB, Android Studio, npx cap run --url (Capacitor 9) vs -l --host (8), xcrun simctl openurlprivacypush, xcrun devicectl device process launchopenURL, xctrace. Do not use for only reading device logs (ios-android-logs), the UIScene migration itself (capacitor-uiscene-migration), deep-link setup (capacitor-deep-linking), speed (capacitor-performance), crash SDKs (capacitor-native-observability), tests (capacitor-testing), or upgrades/build errors (capacitor-app-upgrades, cocoapods-to-spm).
capacitor-testing
cap-go/capgo-skills
Testing guide for Capacitor apps and plugins. Covers web-layer unit and component tests with Vitest and mocked Capacitor plugins (vi.mock('@capacitor/core'), registerPlugin), Playwright for the web build, Appium E2E with NATIVEAPP / WEBVIEW context switching, native plugin unit tests with Swift Testing vs XCTest (what can migrate, CAPPluginCall patterns, xcodebuild test on a simulator) and Android JUnit, plus an agent-driven verification loop on simulators and devices (build, install, launch, screenshot, UI hierarchy, tap, logs) with xcrun simctl, xcrun devicectl, adb, Xcode MCP device tools, and live reload via npx cap run --url (Capacitor 9) or -l --host --port (Capacitor 8). Use when adding tests, mocking plugins, "does it work on device", verifying a UI change on a simulator, migrating XCTest to Swift Testing, or setting up test CI. Do not use for crash log capture (ios-android-logs), WebView debugging sessions (debugging-capacitor), or build pipelines (capacitor
safe-area-handling
cap-go/capgo-skills
Fixes notch, Dynamic Island, home indicator, display cutout, and system bar overlap in Capacitor apps. Covers viewport-fit=cover + env(safe-area-inset-), the Capacitor 8 SystemBars core plugin (insetsHandling, injected --safe-area-inset- CSS variables for Android WebView < 140, removal of android.adjustMarginsForEdgeToEdge), Android 15/16 enforced edge-to-edge (overlaysWebView and backgroundColor of @capacitor/status-bar no longer work at targetSdk 36), iOS contentInset, and insets that change at runtime on rotation, iPad/foldable resizable windows. Use when headers sit under the status bar, tab bars hide behind the gesture bar, env() returns 0 on Android, or layout broke after upgrading to Capacitor 8 / targetSdk 35+. Do not use for keyboard overlap (capacitor-keyboard), Ionic/Konsta component theming (ionic-design, konsta-ui), Tailwind utility setup (tailwind-capacitor), or iOS multi-window/resizability adoption (capacitor-ios-resizability).
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.