Skip to content

v0.11.0

Choose a tag to compare

View all tags
@jefflinse jefflinse released this 07 Jun 01:47
· 5 commits to main since this release
v0.11.0
eafeb5f

OAuth2 support

clic now authenticates against OAuth2-secured APIs — the last unsupported OpenAPI security scheme.

  • Client credentials (machine-to-machine) — pass --client-id/--client-secret (or CLIC_CLIENT_ID/CLIC_CLIENT_SECRET); clic fetches and caches an access token automatically.
  • Authorization code + PKCE (user sign-in) — opens your browser, catches the redirect on a loopback server, and caches the token with its refresh token. Auto-launches when a terminal is attached; in scripts/CI it asks you to run clic login first.

New commands and flags:

  • clic login <spec> / clic logout <spec> to manage cached tokens.
  • --client-id, --client-secret, --scopes, --oauth-flow, --redirect-url (each with CLIC_* env fallback).

Tokens are cached under ~/.clic/tokens/ (mode 0600), keyed by issuer + client + scopes, and refreshed silently. OpenAPI oauth2 security schemes are read automatically (token/authorization URLs and scopes). The authorization-code redirect defaults to http://127.0.0.1:9799/callback (override with --redirect-url).

In the studio, press A to sign in without leaving the keyboard; the top bar shows 🔒/🔓 auth status, and the token is shared with the headless CLI cache.

Assets 2
Loading