← Về thư mục

---

name: api-credential-acquisition description: "Guides the process of acquiring API keys or access tokens for various external services, including web navigation, account creation, storage, and proxy setup for blocked/non-API services like Google Scholar." version: 1.2.0 author: Hermes Agent license: MIT platforms: [linux, macos, windows] metadata: hermes: tags: [API, Credentials, Authentication, Setup, Research, Data Access, Proxy] related_skills: [paper-search-mcp] linked_files: references: [google-scholar-proxy-rotation.md]

---

API Credential Acquisition Workflow

This skill covers systematic acquisition of API keys/access tokens for research services (academic databases, content platforms), including proxy setup for services that lack official APIs (Google Scholar).

Workflow Steps

1. Identify Required Credentials:

   • Determine which services require API keys/tokens.
   • Some services (Semantic Scholar, DOAJ) work without keys at reduced rate limits — document and move on.

2. Locate API Documentation/Registration Page:

   • Use web_search or browser_navigate to find the official API documentation or a dedicated "Request API Key" / "Developers" section.
   • Look for terms like "API", "Developers", "Access Token", "Personal Access Token", "Register", "Sign Up".

3. Review Authentication Method:

   • Understand how the API expects to be authenticated (e.g., API key in header, OAuth, token in URL).
   • Check rate limits and usage policies.

4. Account Creation/Login:

   • If an account is required, guide the user to create one or provide their existing login credentials.
   • Use browser_navigate, browser_type, and browser_click to interact with registration/login forms.
   • Pitfall: Some services require logged-in session to show API key request forms. If clicking "Request an API key" doesn't produce a form, try Sign In first then retry.
   • Pitfall: Many platforms require human interaction (CAPTCHA, email verification). Hand off to the user with clear instructions.

5. Generate/Request API Key/Token:

   • Follow the service's specific instructions to generate the key/token.
   • This often involves navigating to "Settings", "Applications", or "API Access" within the user's profile.
   • Copy the generated key/token immediately as it may not be shown again.

6. Secure Storage:

   • Store credentials in the tool-specific .env file (e.g., ~/.config/paper-search-mcp/.env).
   • Use terminal with Python string manipulation to target a single key: parse the file, replace the matching line, write back.
   • Example snippet (preferred method — avoids leaking secrets via echo/cat): python import os path = os.path.expanduser("~/.config/paper-search-mcp/.env") with open(path) as f: lines = f.readlines() new_lines = [] for line in lines: if line.startswith("PAPER_SEARCH_MCP_ZENODO_ACCESS_TOKEN="): new_lines.append(f"PAPER_SEARCH_MCP_ZENODO_ACCESS_TOKEN={token}\n") else: new_lines.append(line) with open(path, "w") as f: f.writelines(new_lines)

7. Proxy Setup for Google Scholar (No-API Services):

   • Google Scholar has NO official API. The paper-search-mcp tool uses web scraping.
   • You MUST provide a proxy URL in PAPER_SEARCH_MCP_GOOGLE_SCHOLAR_PROXY_URL or Google Scholar will ban the VPS IP after a few requests (429/CAPTCHA).
   • Self-service approach (preferred — do not ask user): Use free HTTP proxy lists from GitHub, test against scholar.google.com, auto-update .env. See references/google-scholar-proxy-rotation.md for the script and cron setup.
   • For production use, recommend a paid rotating proxy service (ScraperAPI, ZenRows).

8. Tool Configuration/Integration:

   • After adding credentials, the MCP server loads them from the .env file on next tool invocation.
   • Remind the user to run /reset to refresh the agent session and pick up new tools.

When to Skip / Abandon a Service

• If email-based key request produces no email after multiple attempts → skip, use free tier if available.
• If registration form requires unavailable info (university affiliation, partnership) → document as blocked, inform user.
• If a service's public endpoints work without auth → skip key acquisition entirely (DOAJ is an example).

Pitfalls and Troubleshooting

• Human Interaction Required: Many platforms require manual steps. Be prepared to hand off to the user for CAPTCHA, email verification, legal agreements.
• Hidden Forms/Dynamic Content: If browser_snapshot doesn't show interactive elements, try browser_scroll, browser_vision, or look for alternative key request methods.
• Rate Limits: API calls without authentication may hit rate limits quickly.
• Expired Tokens: Tokens can expire. If API calls start failing, check the token's validity and regenerate.
• Permission Scopes: Ensure the generated token has the necessary scopes for the tasks it will perform.
• Missing API Key Request Page: Some APIs do not offer public key requests and require partnerships or specific application processes. Document findings and inform the user.
• Free Proxy Lifetime: Free HTTP proxies typically live minutes to hours. Always pair with an auto-rotation script (cronjob every few hours) when relying on free proxies. See reference file.
• MCP Server Doesn't Pick Up Changes After .env Update: The MCP server reads .env at startup. After updating .env, the user must run /reset to create a new agent session; existing MCP tools will reload on next invocation.

---

Service-Specific Reference (learned from real sessions)

Academic Services

• CORE API: Required for high-volume academic paper search and download via paper-search-mcp.
• DOAJ API: Required for searching the Directory of Open Access Journals without low rate limits.
• Semantic Scholar API: Highly recommended to avoid HTTP 429 errors during deep research.
• Zenodo Token: Required for authenticated requests to Zenodo repository.

Setup Steps for Paper-Search-MCP

If using the paper-search-mcp server, ensure the following environment variables are set in the configuration or shell: - CORE_API_KEY - DOAJ_API_KEY - SEMANTIC_SCHOLAR_API_KEY - ZENODO_ACCESS_TOKEN

Semantic Scholar

• Status: Skip — free tier sufficient. Most endpoints (paper search, author lookups) work without a key at 1 RPS. Key request email often fails silently. Don't block on this.

Zenodo

• Status: Easy — user can generate a token. Login → Applications → Personal Access Tokens → create a new token with appropriate scopes.
• Token format: Long alphanumeric string. User can paste it directly.

CORE

• Status: Registration requires institutional affiliation. The CORE registration form asks for organization/university name and intended use. If user is stuck, they likely need to fill in their company/institution.

DOAJ

• Status: No API key needed. DOAJ's public search API endpoints work without authentication. Just use the tool directly.

Google Scholar

• Status: Requires proxy. No official API. See references/google-scholar-proxy-rotation.md for free proxy auto-rotation setup. Recommend a paid proxy service for production.

Unpaywall

• Status: Email only, no key. Provide an email address for rate limiting (good API citizenship). Set PAPER_SEARCH_MCP_UNPAYWALL_EMAIL to any email.