Skip to content

feat(auth): add actual auth create-token for non-interactive auth #801

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
benw5483 wants to merge 5 commits into
base: main
Choose a base branch
from
Open

feat(auth): add actual auth create-token for non-interactive auth #801

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0d0a5f9
feat(auth): add `actual auth create-token` for scoped, non-interactiv…
benw5483 Jun 30, 2026
6b24d73
fix(auth): correct issuance endpoint and build the keychain off D-Bus
benw5483 Jul 1, 2026
7cf061c
fix(auth): satisfy the CodeQL salt scan and cover the auth dispatch arm
benw5483 Jul 1, 2026
bd47d80
fix(auth): never orphan an unrevocable PAT on token-store failure
benw5483 Jul 4, 2026
92954b0
test(auth): cover create-token precheck + output error paths to 100%
benw5483 Jul 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
185 changes: 185 additions & 0 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

18 changes: 18 additions & 0 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,24 @@ glob = "0.3"
# Crypto
sha2 = "0.10"
base64 = "0.22"
# Scoped personal-access-token storage: OS keychain (primary) with an
# AEAD-encrypted-file fallback for headless Linux/CI where no OS keychain is
# available. `keyring` is the portable keychain abstraction; chacha20poly1305 +
# argon2 protect the fallback file at rest.
#
# The Linux backend is `linux-native` (kernel keyutils), NOT `sync-secret-service`.
# The Secret Service backend links the system `libdbus` at build time through
# pkg-config, so it fails to *compile* on a headless / CI Linux host that lacks
# `libdbus-1-dev` — a harder failure than a runtime missing-daemon error. keyutils
# is pure syscalls: no build-time system dependency, no D-Bus daemon, so it builds
# everywhere and works headless. See docs/AGENT_AUTH.md for the finding.
keyring = { version = "3", default-features = false, features = [
"apple-native",
"windows-native",
"linux-native",
] }
chacha20poly1305 = "0.10"
argon2 = "0.5"

# Async utilities
futures = "0.3"
Expand Down
5 changes: 5 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,6 +122,7 @@ you've written yourself.
actual adr-bot # analyze repo & write AI context files
actual status # check output file state (managed markers, staleness)
actual auth # verify authentication
actual auth create-token # mint a scoped token for CI / agents (prototype)
actual config show # view current configuration
actual config set # set a config value
actual config path # print config file location
Expand All @@ -130,6 +131,10 @@ actual models # list known model names grouped by runner
actual cache clear # clear local analysis and tailoring caches
```

For non-interactive (CI / agent) authentication with scoped access tokens, see
[Agent authentication](docs/AGENT_AUTH.md). It also covers the
dedicated-token-per-agent and never-in-prompt rules agents must follow.

## Configuration

Config lives at `~/.actualai/actual/config.yaml` and is created automatically
Expand Down
Loading
Loading