Flickr Integrations for AI Agents

You want an assistant that can find a photo, tell you what changed, or describe an album. That is a reasonable Flickr integration. The awkward part is how Flickr signs the request.

Flickr's API documentation says you must sign requests, and that the method it supports is OAuth 1.0a. That is an older style. Instead of sending one access token the way many newer APIs do, each request is signed using a set of secrets tied to your app and to the person who approved it. Those secrets are the ability to sign the next request. They do not belong in a chat transcript, a prompt, or a repository.

This article connects Flickr so the assistant can look photos up, and the signing secrets stay on your machine. The next section defines Swytchcode. After that are five Flickr agents you can start by pasting a prompt. You do not need to build the signature yourself.

Flickr in the directory is here. How a credential stays out of the model is in this article: credential brokering.

What Swytchcode is

Swytchcode is a production runtime for AI agents. The model decides which API call to make. Swytchcode runs that call. It is not the model, and it does not ask you to sign Flickr requests by hand.

On every call it does eight checks:

1. Allow list. Only an action you added with swy add method can run.
2. Schema check. Inputs are checked against that action before the request is sent.
3. Policy. Rules in policies.json can allow, deny, or hold a call.
4. Credentials. The Flickr secrets are added when the call runs. They are not put in the chat. You store them with swy auth connect. There is no project env file for them.
5. Execution. The request goes from your machine straight to Flickr.
6. Retry. Swytchcode backs off on rate limits. A create or an update is retried only when an idempotency key is already set.
7. Response check. A success status whose body says the action failed is not treated as success.
8. Audit. The call and the policy decision are written to a local log.

Test or live mode is chosen once with swy init and stored in .swytchcode/tooling.json.

Flickr agents you can build

Paste one prompt into Claude Code, Cursor, or Codex. Approve read access on Flickr's screen. Do not paste the API secret into the chat.

1. Recent photos agent

Lists photos from your account. It does not upload or delete.

Set up https://www.swytchcode.com/skills.md and build a Flickr recent-photos agent. List my recent photos with title and date. Do not upload, edit, or delete. Do not ask me to paste the API secret into the chat.

2. Tag search agent

Finds photos for a tag you name.

Set up https://www.swytchcode.com/skills.md and build a Flickr tag-search agent. When I give you a tag, find matching photos and show title and link. Do not change tags. Do not delete photos.

3. Album agent

Lists what is in one album you name.

Set up https://www.swytchcode.com/skills.md and build a Flickr album agent. When I name an album, list the photos in it. Do not add or remove photos from the album.

4. Photo detail agent

Reads the title and description of one photo.

Set up https://www.swytchcode.com/skills.md and build a Flickr photo-detail agent. When I give you a photo, show its title, description, and tags. Do not edit them.

5. New-photo digest

Says what was added recently. It does not clean anything up.

Set up https://www.swytchcode.com/skills.md and build a Flickr digest agent. Summarize photos added since the date I give you. Read only. Do not delete duplicates. Do not upload.

How Flickr OAuth 1.0a signing works

With a typical modern API, you connect once and a bearer token is attached later. If that token leaks into a log, you rotate it. The shape is still "one secret on the request."

Flickr's documented flow is stricter about the signature. Your app has a key and a secret, and the person who approves the app yields a token and a token secret. Requests are signed with that material. An assistant that can read all of those values can ask Flickr as that person. Hiding them in a paragraph of instructions is not hiding.

swy auth connect flickr is where you give Swytchcode the credential. It is stored outside the project. When a call runs, Swytchcode attaches what the call needs. If a form in the chat asks you to paste the consumer secret or the token secret, stop. That form is the wrong place.

Permissions on Flickr's side still matter. Their authorization screen can ask for read, write, or delete. Approve the smallest one that matches the job. A read-only approval cannot be widened by a sentence in the prompt, but a delete approval can be used by any action you turn on. Turn on a lookup first.

Do not assume a retry is a harmless second read of a write. If the assistant uploads or changes a photo and hears nothing back, look to see whether it happened. Swytchcode retries a create or an update only when an idempotency key is set. Flickr's signing docs are not a promise that a second upload is ignored.

Follow these steps to connect Flickr

swy is the short name for the Swytchcode program.

1. Follow this step to install the CLI

If you use Node.js:

npm install -g swytchcode

On Windows PowerShell:

irm https://cli.swytchcode.com/install.ps1 | iex

On macOS or Linux:

curl -fsSL https://cli.swytchcode.com/install.sh | sh

Then swy --version. The CLI quickstart has the rest.

2. Follow this step to sign in

swy login

This is the Swytchcode account. It is not the Flickr key. See the authentication docs.

3. Follow this step to start in test mode

swy init --editor=claude --mode=sandbox

Use cursor or codex if that is your editor. Test mode is saved in .swytchcode/tooling.json. See Set up a project.

4. Follow this step to download Flickr

swy get flickr

This does not turn every Flickr action on.

5. Follow this step to find a photo lookup

swy discover "find my photos" --project flickr

Use the name it prints. --project flickr keeps the search inside Flickr. Do not copy a method name from an old note, including this article.

6. Follow this step to see the fields

swy info <id from discover>

Replace <id from discover> with the name from step 5. Run it after step 4.

7. Follow this step to turn that lookup on

swy add method <id from discover>

Leave upload, edit, and delete off until you have seen a lookup work and you know which Flickr permission you approved.

8. Follow this step to store the Flickr credential

swy auth connect flickr

If the prompt asks you to paste secrets into the chat instead, stop. The credential belongs in this command, on your machine.

FAQ

Why is Flickr different from most APIs an agent calls?

Flickr's documentation says requests are signed with OAuth 1.0a. You are dealing with a set of secrets used to sign calls, not a single bearer token you drop in a header and forget. Those secrets should not be in the chat.

Can the assistant see my Flickr key?

Not on this path. Swytchcode stores it outside the project and attaches it when the call runs. Pasting it into Claude, Cursor, or Codex creates a second path these rules do not cover.

Should I approve delete access to make the demo easier?

No. Approve read access until the assistant only needs to find photos. Delete is a separate Flickr permission and a separate action you would have to turn on.

The directory prompts mention creating records. Is that on?

No. Those lines are examples. You turn on one action with the steps in this article.

Read next

• Explore this article on where logins live: credential brokering.
• The authentication docs explain swy auth connect apart from your Swytchcode account.

Find photos before you change any

Start at step 1 if the CLI is not installed. Ask the assistant to find photos. Do not ask it to delete or replace one.

You can give Claude Code, Cursor, or Codex skills.md and ask it to follow these steps in test mode.

If a screen asks you to paste a Flickr secret into the chat, do not paste it. Discord is a fine place to ask what the screen should have been. The contact form is there if you would rather not share the details in a channel.