fix: stop reading WORKOS_CLIENT_ID for CLI auth#113
Merged
Conversation
The CLI's device auth flow read WORKOS_CLIENT_ID from the environment to resolve its OAuth client ID. This collides with the same env var that every WorkOS-integrated app sets for its own client ID, causing 401 errors on `workos auth login` when the user's app client ID lacks the device_code grant type. The CLI's auth client ID is a fixed value — hardcode it directly instead of reading from the environment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
getCliAuthClientId()was readingWORKOS_CLIENT_IDfrom the environment to resolve the CLI's OAuth client ID. This collides with the same env var that every WorkOS-integrated app sets for its own client ID.WORKOS_CLIENT_IDset (common for any WorkOS developer),workos auth loginsends their app's client ID to the device auth endpoint, which returns 401 because that client doesn't have thedevice_codegrant type.Test plan
pnpm buildpassespnpm testpasses (1525 tests)pnpm typecheckpassesWORKOS_CLIENT_ID=client_01BOGUS workos auth loginno longer returns 401workos auth login(no env override) still works as before