App APIs

Call a deployed application’s own REST API — Airflow, Airbyte, Superset — from the command line or a script, authenticated with short-lived, per-app credentials.

Every app is reachable through the SkaleData data plane at https://<app>.skaledata.run. The skale app commands mint a credential scoped to a single app instance and, with skale app exec, inject it into a subprocess so it never touches your shell history or disk. This is the recommended way for automated sessions — CI jobs, coding agents — to reach app APIs off a single browser login.

Recommended: `skale app exec`

Run any command with the app’s URL and a fresh token injected into its environment:


skale app exec --app airflow --cluster <cluster-id> -- \
  curl "$AIRFLOW_URL/api/v2/dags" -H "Authorization: Bearer $AIRFLOW_TOKEN"

skale app exec mints a token, sets the variables below on the child process only, runs your command, and forwards its exit code. The token is never written to disk or printed — ideal for agents and CI logs where the command’s output is captured.

Put -- before your command so its own flags aren’t parsed by skale.

Injected environment variables

Variable	Description
`SKALE_APP_URL`	Base URL of the app, e.g. `https://<app>.skaledata.run`
`SKALE_APP_TOKEN`	The short-lived bearer token
`<APP>_URL`	App-specific alias, e.g. `AIRFLOW_URL`, `AIRBYTE_URL`
`<APP>_TOKEN`	App-specific alias, e.g. `AIRFLOW_TOKEN`, `AIRBYTE_TOKEN`

Scripts and SDKs: `skale app token`

When you need the raw token — for a long-running script, an SDK client, or piping into other tooling — print it directly:


URL=$(skale app token --app airflow --cluster <cluster-id> --json | jq -r .base_url)
TOKEN=$(skale app token --app airflow --cluster <cluster-id>)
 
curl "$URL/api/v2/dags" -H "Authorization: Bearer $TOKEN"

Add --json to also get the base URL and expiry:


{
  "token": "eyJ...",
  "token_type": "Bearer",
  "app_type": "airflow",
  "base_url": "https://<app>.skaledata.run",
  "expires_at": "2026-07-25T21:18:55Z",
  "expires_in": 900
}

Prefer skale app exec when you can — skale app token prints the token to stdout, so it can land in your shell history or logs.

Flags

Flag	Description
`--app`	Application type: `airflow`, `airbyte`, … (required)
`--cluster`	Cluster ID (prompts if omitted)
`--name`	App instance name, for clusters running multiple instances of a type
`--ttl`	Requested token lifetime (default `15m`, server maximum `1h`)
`--json`	(`token` only) print the full JSON response instead of just the token

The REST path depends on the app. Airflow 3 exposes its public API under /api/v2/ (e.g. /api/v2/dags); other apps use their own paths.

How it works

You authenticate once with skale login — a session valid for roughly 8 hours.
Each skale app token / skale app exec call exchanges that session for a short-lived token scoped to one app instance on one cluster. A token minted for Airflow on cluster A cannot be replayed against a different app or cluster.
The token carries your existing permissions; the app enforces them.
Requests are validated at the data-plane proxy, which forwards authenticated traffic to the app.

CI and headless: API keys

If you can’t run an interactive skale login — a CI pipeline, a bot — use a long-lived API key instead. API keys authenticate directly against the data plane, with no exchange step:


curl -H "Authorization: Bearer sdk_..." \
  https://<app>.skaledata.run/api/v2/dags

Create one from the API Keys page in the console, and see API key scopes for what each key can access.