API Integration Guide

API Integration Guide

【免费下载链接】caveman🪨 why use many token when few token do trick — Claude Code skill that cuts 65% of tokens by talking like caveman项目地址: https://gitcode.com/GitHub_Trending/caveman1/caveman

Authentication

All API requests include valid JWT in Authorization header. Get token from login endpoint using credentials. If expired, use refresh token to get new access token, retry request.

Auth example:

const login = async (email: string, password: string) => { const response = await fetch('/api/auth/login', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ email, password }), }); const { accessToken, refreshToken } = await response.json(); return { accessToken, refreshToken }; };

Access token expires in 15 min. On 401 → refresh token.

const refreshAccessToken = async (refreshToken: string) => { const response = await fetch('/api/auth/refresh', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ refreshToken }), }); if (!response.ok) throw new Error('Refresh failed'); const { accessToken } = await response.json(); return accessToken; };

Creating Tasks

Create task → POST/api/v2/tasks.

Required:projectId,titleOptional: others use defaults

priority: 1 (low) → 5 (high), default 3

interface CreateTaskPayload { projectId: string; title: string; description?: string; assigneeId?: string; priority?: 1 | 2 | 3 | 4 | 5; dueDate?: string; // ISO 8601 format labels?: string[]; } const createTask = async (payload: CreateTaskPayload, token: string) => { const response = await fetch('/api/v2/tasks', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}`, }, body: JSON.stringify(payload), }); return response.json(); };

Response includes:id,createdAt,status(default"todo").

Error Handling

All errors return:

• code— machine-readable
• message— human-readable
• details— optional extra info

Common errors:

• AUTH_TOKEN_EXPIRED— refresh + retry
• AUTH_TOKEN_INVALID— login again
• VALIDATION_ERROR— checkdetails
• NOT_FOUND— resource missing / no access
• RATE_LIMIT_EXCEEDED— wait (Retry-After)

Pattern:

class ApiError extends Error { constructor( public code: string, public status: number, message: string, public details?: Record<string, string[]> ) { super(message); } } const apiClient = async (url: string, options: RequestInit = {}) => { const response = await fetch(url, { ...options, headers: { 'Content-Type': 'application/json', ...options.headers, }, }); if (!response.ok) { const error = await response.json(); throw new ApiError(error.code, response.status, error.message, error.details); } return response.json(); };

Pagination

All list endpoints use cursor-based pagination. Better than offset for consistency with concurrent changes.

Response includescursor. Pass as query param for next page.

Defaults:

• page size: 50
• max: 100 (limit)

Fetch all tasks:

const fetchAllTasks = async (projectId: string, token: string) => { let cursor: string | undefined; const allTasks = []; do { const params = new URLSearchParams({ limit: '50' }); if (cursor) params.set('cursor', cursor); const response = await apiClient( `/api/v2/projects/${projectId}/tasks?${params}`, { headers: { Authorization: `Bearer ${token}` } } ); allTasks.push(...response.data); cursor = response.cursor; } while (cursor); return allTasks; };

Rate Limiting

Limits:

• Authenticated: 100 req/min
• Unauthenticated: 20 req/min

On exceed → 429 +Retry-After.

Client strategy:

• Use exponential backoff
• Start withRetry-After
• Double each retry
• Max wait: 60s

Prevents thundering herd.

Webhooks

Supports outgoing webhooks for events:

• task created, updated, deleted, assigned, status change

Configured in project settings. Sends POST with event payload.

Security:

• Header:X-Taskflow-Signature
• HMAC-SHA256 of body using webhook secret
• Always verify before processing

import crypto from 'crypto'; const verifyWebhookSignature = ( payload: string, signature: string, secret: string ): boolean => { const expected = crypto .createHmac('sha256', secret) .update(payload) .digest('hex'); return crypto.timingSafeEqual( Buffer.from(signature), Buffer.from(expected) ); };

从结构上看，压缩产物与原文保持一一对应：H1 + 6 个 H2 标题（`Authentication`、`Creating Tasks`、`Error Handling`、`Pagination`、`Rate Limiting`、`Webhooks`）全部原样保留，5 个 `typescript` 围栏代码块逐字节未变，行内代码（`` `projectId` ``、`` `AUTH_TOKEN_EXPIRED` ``、`` `Retry-After` ``、`` `X-Taskflow-Signature` `` 等）全部保留，端点路径字符串 `/api/v2/tasks` 等完整无损。 ## 3. 原文 vs 压缩文：逐章节对比"变"与"不变" 把原文与压缩产物按章节对照，可以清晰看到 [SKILL.md](https://link.gitcode.com/i/878c9466c97aa69b0c7f4eef7e112806) 中压缩规则的实际落点： | 章节 | 原文（节选） | 压缩后（节选） | 规则映射 | |------|------------|--------------|---------| | Authentication | "All API requests **must** include **a** valid JWT token in **the** Authorization header. **The** token is obtained **by calling** the login endpoint **with valid** credentials. **If the** token has expired, **the** client **should** use **the** refresh token to obtain a new access token before retrying **the** failed request." | "All API requests include valid JWT in Authorization header. Get token from login endpoint using credentials. If expired, use refresh token to get new access token, retry request." | 删除冠词 a/an/the、情态词 should/must、冗余从句；信息量（端点、机制）不变 | | Authentication | "The access token expires after 15 minutes. When you receive a 401 response, you should attempt to refresh the token:" | "Access token expires in 15 min. On 401 → refresh token." | "you should attempt to" 整段删除，直接陈述动作；数字 15、401 精确保留 | | Creating Tasks | "To create a new task, you need to send a POST request to the tasks endpoint **with the required fields**. The `projectId` and `title` fields are required. **All other fields are optional and will use sensible defaults if not provided**. The `priority` field accepts values from 1 (lowest) to 5 (highest), with 3 being the default." | "Create task → POST `/api/v2/tasks`. Required: `projectId`, `title` Optional: others use defaults. `priority`: 1 (low) → 5 (high), default 3" | 散文压成短句+符号；行内代码 `` `projectId` ``、`` `title` `` 一字未动 | | Error Handling | "Every error response includes a `code` field with a machine-readable error identifier and a `message` field with a human-readable description." | "All errors return: * `code` — machine-readable * `message` — human-readable * `details` — optional extra info" | 长句拆为符号列表；错误码枚举 `AUTH_TOKEN_EXPIRED` 等 5 项完整保留 | | Pagination | "This approach was chosen over offset-based pagination because it provides consistent results even when items are being added or removed concurrently." | "Better than offset for consistency with concurrent changes." | "in order to" 类冗词删除，碎片句 OK | | Rate Limiting | "It is recommended that your client application implements exponential backoff when encountering rate limit errors. Starting with the `Retry-After` value, double the wait time on each subsequent 429 response, up to a maximum of 60 seconds. This prevents thundering herd problems when multiple clients hit the rate limit simultaneously." | "Client strategy: * Use exponential backoff * Start with `Retry-After` * Double each retry * Max wait: 60s. Prevents thundering herd." | "It is recommended that…" 客套语全部删除；阈值 100/20 req/min、60s 精确保留 | | Webhooks | "Webhook payloads include an `X-Taskflow-Signature` header containing an HMAC-SHA256 signature of the request body using your webhook secret. Always verify this signature before processing the webhook to ensure the request is authentic." | "Security: * Header: `X-Taskflow-Signature` * HMAC-SHA256 of body using webhook secret * Always verify before processing" | 术语（HMAC-SHA256）、header 名精确保留 | 而 5 个代码块（login/refresh 函数、`CreateTaskPayload` 接口与 `createTask`、`ApiError` 类与 `apiClient`、`fetchAllTasks` 分页循环、`verifyWebhookSignature` HMAC 校验）在两份文件中**逐字符一致**——这正是 [SKILL.md](https://link.gitcode.com/i/878c9466c97aa69b0c7f4eef7e112806) 中 CRITICAL RULE 所要求的行为： > Anything inside ``` ... ``` must be copied EXACTLY. Do not remove comments, remove spacing, reorder lines, shorten commands, simplify anything. Inline code (`...`) must be preserved EXACTLY. ## 4. 源码机制一：代码块如何被"掩码保护"送进 LLM 仅靠提示词约束 LLM"别动代码"并不可靠，`caveman-compress` 在 [skills/caveman-compress/scripts/compress.py](https://link.gitcode.com/i/215d7605f79d5cbcb33f249d59cbf50a) 中实现了一套**掩码—还原**机制，把代码块从 LLM 视野中物理隔离： 1. **掩码**：[mask_code_blocks()](https://link.gitcode.com/i/215d7605f79d5cbcb33f249d59cbf50a#L488-L533) 在压缩前扫描正文，把每一个围栏代码块（```` ``` `

【免费下载链接】caveman🪨 why use many token when few token do trick — Claude Code skill that cuts 65% of tokens by talking like caveman项目地址: https://gitcode.com/GitHub_Trending/caveman1/caveman