v0.2.2

What's changed

• Fix runtime resolution of 1Password op://... credential references.
• Let the CLI, adapter, and MCP server resolve credentials from OKTA_*, generated op.env files, or configured 1Password references without requiring op run.
• Add regression coverage for the op provider path used by non-interactive consumers such as moodle-cli.

Notes

This is a small patch release focused on 1Password-backed runtime credential loading.

v0.2.0

Upgrade

• uv tool: uv tool upgrade okta-auth-cli
• pipx: pipx upgrade okta-auth-cli
• pip: pip install -U okta-auth-cli

After upgrading, run okta config if you want to switch to the new keyring or op credential setup flows.

Highlights

• Add an interactive okta config wizard for local credential setup.
• Add secure OS keyring storage for username, password, and optional TOTP secret.
• Add a 1Password CLI (op) provider that generates ~/.okta-auth/op.env with op://... references.
• Add provider-aware credential resolution for both the CLI and MCP server.

Security and Reliability

• Make okta config --reset fail clearly when keyring cleanup does not succeed.
• Remove existing keyring secrets before switching from keyring to op.
• Validate 1Password vault, item, and field names before generating secret references.
• Improve status output and operator guidance for credential providers.

Docs

• Document the new config wizard and storage model in the README.
• Document recommended keyring usage and op run setup for 1Password.

Validation

• uv run python -m pytest
• 17 passed