platform-models-api-configure

Q: How do I install platform-models-api-configure?

Run npx skills add https://github.com/forcedotcom/sf-skills --skill platform-models-api-configure in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/platform-models-api-configure/ (personal) or .claude/skills/platform-models-api-configure/ (project).

by forcedotcomBackend & APIs

Configure (or troubleshoot) an AI coding agent or CLI to route through the Salesforce Models API using a signed OrgJWT. Use this skill when pointing an agent at the Salesforce model endpoint (api.salesforce.com/ai/gpt/v1), setting up OrgJWT / Bedrock-mode auth, wiring the agent's settings, API-key helper, and credentials file for the Salesforce endpoint, or fixing Models API 401 / 404 / "model not available" errors. DO NOT TRIGGER when the user needs to create or configure the Salesforce Connected App itself (use integration-connectivity-connected-app-configure) or set up Named Credentials / callout auth (use integration-connectivity-generate).

Installs: 4.2K
Last 24h: —
Trending rank: —
Security: Pass

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/forcedotcom/sf-skills --skill platform-models-api-configure

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads platform-models-api-configure automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

Security audits

Independent scans of the skill's instructions and bundled files.

Gen Agent Trust Hub PassSAFE ·This skill provides a secure reference implementation for connecting AI agents to the Salesforce Models API. It follows industry best practices for local secret management and contains a robust authentication helper script that avoids common shell execution vulnerabilities.

Socket PassNo alerts

Snyk PassLOW ·Risk: LOW · No issues

SKILL.md

The instructions your agent reads when the skill is triggered.

Salesforce Models API setup for an AI coding agent

The Salesforce Models API (https://api.salesforce.com/ai/gpt/v1) is authenticated with a signed OrgJWT (obtained via client_credentials with the sfap_api scope — see scripts/get-orgjwt.sh; no proxy). That auth and the base URL are the same for any agent. How each agent then talks to the endpoint is agent-specific: Anthropic clients (Claude Code and the Claude Agent SDK) route through Bedrock mode (the env vars in Step 3), whereas other agents (e.g. Codex) use their own client config against the same endpoint and token — Bedrock mode does not apply to them.

The steps below are the Claude Code / Claude Agent SDK reference implementation (Bedrock mode + a JSON settings file + an API-key helper). For a non-Bedrock agent, reuse the OrgJWT auth (Step 1) and the base URL, and apply the equivalent client settings in that agent's own config location instead of the Bedrock env vars.

Bundled scripts are in scripts/. Path placeholders below: <SKILL> = the absolute path to this skill's own directory (the folder containing this SKILL.md; resolve it from the skill path in context). <ABS> = the absolute path to the user's project root. Always emit fully resolved absolute paths — the API-key helper runs from an undefined working directory, so relative paths break it.

Prerequisite

A connected app in the org with the sfap_api OAuth scope and the client_credentials flow enabled (consumer key/secret + a run-as user). Setup steps: https://developer.salesforce.com/docs/ai/agentforce/guide/access-models-api-with-rest.html curl + jq installed.

Inputs to collect

SF_INSTANCE_URL — org My Domain, e.g. https://acme.my.salesforce.com
SF_CLIENT_ID, SF_CLIENT_SECRET — connected-app consumer key/secret
Models API base URL: https://api.salesforce.com/ai/gpt/v1
Model: a fully qualified sfdc_ai__… name, e.g. sfdc_ai__DefaultBedrockAnthropicClaude46Sonnet (full list: https://developer.salesforce.com/docs/ai/agentforce/guide/supported-models.html)
Scope: project (<cwd>/.claude/settings.json, default) or user (~/.claude/settings.json) — reference-agent settings paths
Headers — <FEAT> = x-client-feature-id (default ai-platform-models-connected-app), <APP> = x-sfdc-app-context (default EinsteinGPT). Used in the Step 2 verify curl and in ANTHROPIC_CUSTOM_HEADERS.

Steps (reference implementation)

Concrete values for a JSON-settings + API-key-helper agent. Reuse the OrgJWT auth, verify curl, and base URL verbatim for any agent; adapt the settings-file location and env-var wiring to the target agent.

Write <project>/.claude/.orgjwt.env (chmod 600), gitignore it:

SF_INSTANCE_URL="..."
SF_CLIENT_ID="..."
SF_CLIENT_SECRET="..."

Verify — must return 200 before writing settings:

TOKEN=$(bash <SKILL>/scripts/get-orgjwt.sh <ABS>/.claude/.orgjwt.env)
curl -s -o /dev/null -w '%{http_code}\n' \
  <MODELS_API_URL>/model/<MODEL>/invoke-with-response-stream \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -H 'x-client-feature-id: <FEAT>' -H 'x-sfdc-app-context: <APP>' \
  --data '{"anthropic_version":"bedrock-2023-05-31","max_tokens":16,"messages":[{"role":"user","content":"hi"}]}'

Write .claude/settings.json (merge into existing; keep other keys):

{
  "apiKeyHelper": "bash <SKILL>/scripts/get-orgjwt.sh <ABS>/.claude/.orgjwt.env",
  "model": "<MODEL>",
  "env": {
    "ANTHROPIC_AUTH_TOKEN": "",
    "CLAUDE_CODE_USE_BEDROCK": "1",
    "CLAUDE_CODE_SKIP_BEDROCK_AUTH": "1",
    "ANTHROPIC_BEDROCK_BASE_URL": "<MODELS_API_URL>",
    "ANTHROPIC_SMALL_FAST_MODEL": "<MODEL>",
    "ANTHROPIC_DEFAULT_MODEL": "<MODEL>",
    "ANTHROPIC_CUSTOM_HEADERS": "x-client-feature-id: <FEAT>\nx-sfdc-app-context: <APP>"
  }
}

Use absolute paths in apiKeyHelper. (<FEAT> / <APP> defaults are in "Inputs to collect" above.)

Tell the admin to fully restart the agent (claude for the reference agent) — settings and the API-key helper load at startup only.

Capturing as a runbook (when asked to document, not apply)

If the user wants the setup written up for review instead of applied to their machine (e.g. "save it as a Markdown runbook"), write all of the above into the requested file (e.g. models-api-setup-runbook.md), in order and self-contained: the exact .orgjwt.env contents, the chmod 600 + gitignore note, the verification curl (with the "must be 200 before writing settings" note), the full settings.json block with every key from Step 3, and the final "fully restart claude" step. Don't omit any of the nine settings.json keys.

Verify before finishing

Must be exact (each prevents a specific failure)

"ANTHROPIC_AUTH_TOKEN": "" — clears any global token that would otherwise outrank apiKeyHelper (precedence: ANTHROPIC_AUTH_TOKEN > ANTHROPIC_API_KEY

apiKeyHelper). Without it → wrong/old bearer → 401/404.
CLAUDE_CODE_USE_BEDROCK=1 — activates the Bedrock API client; without it Claude Code uses the standard Anthropic API protocol and ignores ANTHROPIC_BEDROCK_BASE_URL entirely, so every call bypasses the Models API.
CLAUDE_CODE_SKIP_BEDROCK_AUTH=1 — else Claude Code overwrites Authorization with AWS SigV4 and the OrgJWT never lands.
apiKeyHelper must be invoked as bash <path> <credsfile> (avoids exit-126).
Model must be a fully qualified sfdc_ai__… name (see supported models).
Auth is the OrgJWT from client_credentials (a signed JWT, 2 dots, scope sfap_api) — NOT sf org display (unsigned session token → 404). sf CLI has no client_credentials command; the helper calls /services/oauth2/token.
Only ANTHROPIC_BEDROCK_BASE_URL routes; no tenant-id header needed.

Diagnose

Error	Meaning	Check first
`401`	Token is not a valid OrgJWT	Connected App `sfap_api` scope, `client_credentials` flow enabled, consumer key/secret in `.orgjwt.env`; `ANTHROPIC_AUTH_TOKEN` not cleared to `""`
`404`	Token valid but model/env/org not routable	Fully qualified `sfdc_ai__…` model alias, `ANTHROPIC_BEDROCK_BASE_URL` exactly `https://api.salesforce.com/ai/gpt/v1`, org entitled for the Models API, `ANTHROPIC_AUTH_TOKEN` cleared
`model not available`	Non-alias model id	Replace with a fully qualified `sfdc_ai__…` alias (see supported models)

FAQ

What does the platform-models-api-configure skill do?

How do I install platform-models-api-configure?

Run npx skills add https://github.com/forcedotcom/sf-skills --skill platform-models-api-configure in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/platform-models-api-configure/ (personal) or .claude/skills/platform-models-api-configure/ (project).

Which AI agents can use platform-models-api-configure?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is platform-models-api-configure safe to install?

Security partners have reviewed it: Gen Agent Trust Hub passed; Socket passed; Snyk passed. As with any skill, read the SKILL.md and bundled scripts before installing.

Who maintains platform-models-api-configure?

It is published by forcedotcom in forcedotcom/sf-skills. It has 4,213 recorded installs.

More from forcedotcom/sf-skills

View all →

platform-apex-generate

forcedotcom/sf-skills

Primary Apex authoring skill for class generation, refactoring, and review. ALWAYS ACTIVATE when the user mentions Apex, .cls, triggers, or asks to create/refactor a class (service, selector, domain, batch, queueable, schedulable, invocable, DTO, utility, interface, abstract, exception, REST resource). Use this skill for requests involving SObject CRUD, mapping collections, fetching related records, scheduled jobs, batch jobs, trigger design, @AuraEnabled controllers, @RestResource endpoints, custom REST APIs, or code review of existing Apex.

Code Quality & Workflow7.1K installs

platform-apex-test-generate

forcedotcom/sf-skills

Use to generate and validate Apex test classes with TestDataFactory patterns, bulk testing (251+ records), mocking, assertions, and disciplined test-fix loops. Use when creating Apex test classes (for triggers, services, controllers, batch jobs, queueables, and callouts), improving coverage, debugging or fixing failing Apex tests, or running test/coverage analysis. Triggers on Test.cls files, sf apex run test, coverage reports. Do NOT trigger for production Apex (use platform-apex-generate) or Jest/LWC tests.

Testing & QA7.1K installs

platform-apex-test-run

forcedotcom/sf-skills

Apex test execution, coverage analysis, and test-fix loops with 120-point scoring. Use when the user runs Apex tests, checks code coverage, fixes failing tests, or touches Test.cls / Test.cls files. DO NOT TRIGGER when writing Apex production code (use platform-apex-generate), Agentforce agent testing (use agentforce-test), or Jest/LWC tests (use experience-lwc-generate).

Testing & QA7K installs

platform-apex-logs-debug

forcedotcom/sf-skills

Salesforce debug log analysis and troubleshooting with 100-point scoring. TRIGGER when: user analyzes debug logs, hits governor limits, reads stack traces, or touches .log files from Salesforce orgs. DO NOT TRIGGER when: running Apex tests (use platform-apex-test-run), generating or fixing Apex code (use platform-apex-generate), or Agentforce session tracing (use agentforce-observe).

Code Quality & Workflow6.8K installs

platform-soql-query

forcedotcom/sf-skills

Use when the user needs SOQL/SOSL authoring or optimization: natural-language-to-query generation, relationship queries, aggregates, query-plan/selectivity analysis, and performance or safety improvements. TRIGGER when the user writes, optimizes, or debugs SOQL/SOSL, touches .soql files, or asks about relationship queries, aggregates, or query performance. DO NOT TRIGGER for bulk data operations (use platform-data-manage), Apex DML logic (use platform-apex-generate), or report/dashboard queries.

Code Quality & Workflow6.8K installs

platform-metadata-deploy

forcedotcom/sf-skills

Salesforce DevOps automation using sf CLI v2. TRIGGER when: user deploys metadata, validates a deploy or does a dry-run, deploys to a Production org, quick-deploys a validated job ID, ships/promotes to prod, creates/manages scratch orgs or sandboxes, sets up CI/CD pipelines, or troubleshoots deployment errors with sf project deploy. DO NOT TRIGGER when: writing Apex code, building LWC components (use experience-lwc-generate), creating metadata definitions (use platform-custom-object-generate), deleting metadata from an org (use platform-destructive-deploy), or querying org data (use platform-data-manage).

DevOps & Cloud6.8K installs

Popular backend & apis skills

View category →

find-skills

vercel-labs/skills

Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.

OfficialBackend & APIs4.1M installs

entra-app-registration

microsoft/azure-skills

Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.

OfficialBackend & APIs566.7K installs

google-agents-cli-adk-code

google/agents-cli

This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).

Backend & APIs514.8K installs

embedded-captions

heygen-com/hyperframes

Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.

Backend & APIs453.3K installs

entra-agent-id

microsoft/azure-skills

Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).

OfficialBackend & APIs336.6K installs

neon

neondatabase/agent-skills

Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.

Backend & APIs237.1K installs

platform-models-api-configure

Install

Install

Describe the task

Review the result

Security audits

SKILL.md

Salesforce Models API setup for an AI coding agent

Prerequisite

Inputs to collect

Steps (reference implementation)

Capturing as a runbook (when asked to document, not apply)

Verify before finishing

Must be exact (each prevents a specific failure)

Diagnose

FAQ

More from forcedotcom/sf-skills

Popular backend & apis skills