Skip to content

feat(auth,oauth): add welcome screen, auth command, and OAuth provider flows#2976

Closed
bloodf wants to merge 1 commit intoultraworkers:mainfrom
bloodf:feature/oauth-provider-auth
Closed

feat(auth,oauth): add welcome screen, auth command, and OAuth provider flows#2976
bloodf wants to merge 1 commit intoultraworkers:mainfrom
bloodf:feature/oauth-provider-auth

Conversation

@bloodf
Copy link
Copy Markdown

@bloodf bloodf commented May 1, 2026

This PR adds interactive provider authentication to claw, including browser-based OAuth for providers that support it.

What's new

Welcome screen

  • Run claw auth or get prompted on first-run when no API key is detected
  • Interactive provider picker with built-in and template providers
  • API key entry with optional save to ~/.claw/settings.json

OAuth support

Provider Method Status
OpenAI PKCE via auth.openai.com ✅ Supported
Moonshot / Kimi Device Authorization Flow (RFC 8628) ✅ Supported
Anthropic, xAI, Z.AI, MiniMax API key only

New infrastructure

  • Per-provider OAuth token storage in ~/.claw/credentials.json
  • Local HTTP callback server for PKCE redirect handling
  • Browser launcher (open/xdg-open/start)
  • Device Authorization Flow polling

API client integration

  • OpenAiCompatClient falls back to saved OAuth tokens when env var unset
  • Bearer token authentication for OAuth providers

Testing

  • cargo check --workspace passes
  • cargo test -p rusty-claude-cli --bin claw -- auth_tests passes
  • cargo test -p runtime -- oauth passes

This adds interactive provider authentication to claw, including
browser-based OAuth for providers that support it.

**Welcome screen ( or first-run):**
- Interactive provider picker with built-in and template providers
- API key entry with optional save to ~/.claw/settings.json

**OAuth support:**
- OpenAI: PKCE flow via auth.openai.com (ChatGPT/Codex accounts)
- Moonshot / Kimi: Device Authorization Flow (RFC 8628)
- Other providers: API key only (Anthropic, xAI, Z.AI, MiniMax)

**New infrastructure:**
- Per-provider OAuth token storage in ~/.claw/credentials.json
- Local HTTP callback server for PKCE redirect handling
- Browser launcher (open/xdg-open/start)
- Device Authorization Flow polling

**API client integration:**
- OpenAiCompatClient falls back to saved OAuth tokens when env var unset
- Bearer token authentication for OAuth-providers
@bloodf
Copy link
Copy Markdown
Author

bloodf commented May 1, 2026

Superseded by #2977 which combines provider profiles, auth, and OAuth into a single PR.

@bloodf bloodf closed this May 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant