auth

Documentation

Index

• Constants
• func CodexLogin(ctx context.Context, client httputil.Doer) (*CodexTokenResponse, *CodexClaims, error)
• func DecodeEmail(token string) string
• func DefaultScopes() []string
• func Login(ctx context.Context, client httputil.Doer) (*TokenResponse, *Profile, error)
• type CodexClaims
  • func DecodeCodexClaims(token string) CodexClaims
  • func (c CodexClaims) RecordKey() string
• type CodexTokenResponse
• type Profile
• type TokenResponse

Constants

const (
	// DefaultExpiresInSec is the fallback token expiry when the server omits expires_in.
	DefaultExpiresInSec = 3600

	// ClaudeClientID is the OAuth client ID for Claude.
	ClaudeClientID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e"
)

const (
	// CodexClientID is the OAuth client ID for Codex (Auth0/OpenAI).
	CodexClientID = "app_EMoamEEZ73f0CkXaXp7hrann"
)

Functions

func CodexLogin

func CodexLogin(ctx context.Context, client httputil.Doer) (*CodexTokenResponse, *CodexClaims, error)

CodexLogin performs the OAuth PKCE flow for Codex/ChatGPT via Auth0. It starts a local server on port 1455, opens the browser, and returns tokens + decoded claims on success.

func DecodeEmail

func DecodeEmail(token string) string

DecodeEmail extracts the email claim from a JWT without verifying the signature. WARNING: The JWT signature is NOT verified. Do not use the result for authentication or authorization decisions.

func DefaultScopes

func DefaultScopes() []string

DefaultScopes returns the full set of OAuth scopes matching Claude Code.

func Login

func Login(ctx context.Context, client httputil.Doer) (*TokenResponse, *Profile, error)

Login performs the OAuth PKCE flow: starts a local server, opens the browser, and returns tokens + profile on success.

Types

type CodexClaims

type CodexClaims struct {
	Email     string
	AccountID string // chatgpt_account_id from "https://api.openai.com/auth"
	UserID    string // chatgpt_user_id from "https://api.openai.com/auth"
	PlanType  string // chatgpt_plan_type from "https://api.openai.com/auth"
	ExpiresAt int64  // top-level "exp" claim
}

CodexClaims holds decoded claims from a Codex/ChatGPT JWT id_token.

func DecodeCodexClaims

func DecodeCodexClaims(token string) CodexClaims

DecodeCodexClaims extracts Codex-specific claims from a JWT id_token without verifying the signature. Account info is nested under the "https://api.openai.com/auth" claim object.

func (CodexClaims) RecordKey

func (c CodexClaims) RecordKey() string

RecordKey returns the codex-auth-compatible account key: "{UserID}::{AccountID}".

type CodexTokenResponse

type CodexTokenResponse struct {
	IDToken      string `json:"id_token"`
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token"`
}

CodexTokenResponse is returned by the Codex OAuth token exchange.

type Profile

type Profile struct {
	Email         string
	AccountUUID   string
	OrgUUID       string
	Plan          string
	RateLimitTier string
	RawJSON       json.RawMessage
}

Profile holds the user's Claude profile.

type TokenResponse

type TokenResponse struct {
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token"`
	ExpiresIn    int64  `json:"expires_in"`
	TokenType    string `json:"token_type"`
	Scope        string `json:"scope"`
}

TokenResponse is returned by the OAuth token exchange.