login

package
v1.50.5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 21, 2026 License: Apache-2.0 Imports: 30 Imported by: 0

Documentation

Overview

Package login implements Stripe authentication flows.

Index

Constants

View Source 
const (
	// DefaultAccessBaseURL is the default (production) base URL for access-srv.
	DefaultAccessBaseURL = "https://access.stripe.com"
	// QAAccessBaseURL is the QA base URL for access-srv, used via --access-base.
	QAAccessBaseURL = "https://qa-access.stripe.com"

	// StripeCLIClientIDProd is the registered OAuth client ID for production.
	StripeCLIClientIDProd = "oacli_V18aOD6v0hs9CU"
	// StripeCLIClientIDQA is the registered OAuth client ID for the QA environment.
	StripeCLIClientIDQA = "oacli_UjA5npk5UKXd9u"
)
View Source 
const OAuthRefreshTokenKeychainKey = config.OAuthRefreshTokenKeychainKey

OAuthRefreshTokenKeychainKey is the keyring key for the OAuth refresh token.

Variables

This section is empty.

Functions

func ClearOAuthCredentials added in v1.45.3 

func ClearOAuthCredentials(cfg *config.Config) error

ClearOAuthCredentials removes the stored access token, refresh token, and compartment data. Call this when the server returns invalid_grant on a refresh attempt.

func InitiateLogin added in v1.39.0 

func InitiateLogin(ctx context.Context, baseURL, accessBaseURL string, cfg *config.Config) error

InitiateLogin prints JSON with browser_url, verification_code, and a next_step command, then returns. Intended for non-interactive (agent/script) use. For the OAuth device-code flow it saves pending state to disk and emits `stripe login --complete-device` as the next_step.

func InteractiveLogin 

func InteractiveLogin(ctx context.Context, cfg *config.Config) error

InteractiveLogin lets the user set configuration on the command line

func ListAuthorizedAccounts added in v1.45.3 

func ListAuthorizedAccounts(ctx context.Context, accessBaseURL, accessToken string) ([]config.AuthorizedAccount, error)

ListAuthorizedAccounts returns the Stripe accounts accessible to accessToken.

func Login 

func Login(ctx context.Context, dashboardBaseURL, accessBaseURL string, cfg *config.Config) error

Login is the main entrypoint for logging in to the CLI.

When the /stripecli/auth server responds with a 3xx, the machine UUID is enrolled in the OAuth feature flag and the OAuth device-code flow is used instead of the legacy RAK flow. accessBaseURL controls which access-srv environment is used (production by default; QA via --access-base).

func LoginWithDeviceCode added in v1.45.3 

func LoginWithDeviceCode(ctx context.Context, accessBaseURL string, cfg *config.Config) error

LoginWithDeviceCode runs the full OAuth 2.1 device-code flow and saves credentials.

func PollForLogin added in v1.39.0 

func PollForLogin(ctx context.Context, pollURL string, cfg *config.Config) error

PollForLogin polls the given legacy poll URL until browser auth completes, then saves credentials. Intended as the second step of a non-interactive legacy login flow. For OAuth, use PollPendingDeviceAuth instead.

func PollPendingDeviceAuth added in v1.45.3 

func PollPendingDeviceAuth(ctx context.Context, cfg *config.Config) error

PollPendingDeviceAuth loads the OAuth device auth state saved by InitiateLogin and polls the token endpoint until the user approves.

func PrintAuthorizedContexts added in v1.45.3 

func PrintAuthorizedContexts(ctx context.Context, accessBaseURL, accessToken string) error

PrintAuthorizedContexts fetches the authorized accounts for accessToken and prints them as a formatted list, marking the active context.

func PrintAuthorizedContextsList added in v1.50.4 

func PrintAuthorizedContextsList(accounts []config.AuthorizedAccount)

PrintAuthorizedContextsList prints already-fetched authorized accounts as a formatted list, marking the active context.

func Reauth added in v1.45.3 

func Reauth(ctx context.Context, accessBaseURL, accessToken string) error

Reauth fetches a reauthentication URL for the active OAuth session and directs the user to it. If a browser is available it is opened automatically; otherwise the URL is printed for the user to visit manually. It then waits for the authorized-accounts list to change before printing the updated list of authorized contexts; access-srv has no dedicated signal for "the user finished reauthorizing," so a change to the accounts/scopes returned for the token is used as a proxy for completion.

func RevokeToken added in v1.45.3 

func RevokeToken(ctx context.Context, accessBaseURL string) error

RevokeToken revokes the stored refresh token via the revocation endpoint. Returns nil if no refresh token is stored. Errors from the server are returned to callers, who should log and continue with credential cleanup.

func SetOpenBrowserForTesting added in v1.42.2 

func SetOpenBrowserForTesting(fn func(string) error) (restore func())

SetOpenBrowserForTesting overrides the browser-opening function used by the login flow. It returns a restore function that resets to the default.

func SuccessMessage added in v0.2.2 

func SuccessMessage(ctx context.Context, account *acct.Account, baseURL string, apiKey string) (string, error)

SuccessMessage returns the display message for a successfully authenticated user

func SwitchContext added in v1.45.3 

func SwitchContext(ctx context.Context, accessBaseURL string, cfg *config.Config, accountID string, livemode bool) error

SwitchContext updates the active OAuth context. If accountID is non-empty it selects that account directly (test mode by default, live if livemode is true). Otherwise it shows an interactive list.

func UpdateOAuthTokens added in v1.45.3 

func UpdateOAuthTokens(cfg *config.Config, resp *OAuthTokenResponse) error

UpdateOAuthTokens replaces the stored access token and refresh token after a successful token refresh. If resp.RefreshToken is empty, the refresh token is left unchanged.

func ValidateAccessBaseURL added in v1.50.1 

func ValidateAccessBaseURL(accessBaseURL string) error

ValidateAccessBaseURL returns an error unless accessBaseURL is exactly the production or QA access-srv origin.

Requests built from this value carry the OAuth user access token (Authorization: Bearer) or the stored refresh token (form body), so unlike --api-base/--dashboard-base there is no dev-host, localhost, or path allowance: any scheme, host, port, userinfo, path, query, or fragment other than these two exact strings risks sending live credentials to an attacker-controlled destination.

Types

type AsyncInputReader added in v1.12.4 

type AsyncInputReader interface {
	// contains filtered or unexported methods
}

AsyncInputReader is an interface that has an async version of scanln

type AsyncStdinReader added in v1.12.4 

type AsyncStdinReader struct {
}

AsyncStdinReader implements scanln(ch chan int), an async version of scanln

type Authenticator added in v1.13.12 

type Authenticator struct {
	// contains filtered or unexported fields
}

Authenticator handles the login flow

func NewAuthenticator added in v1.13.12 

func NewAuthenticator(keytransfer keys.KeyTransfer) *Authenticator

NewAuthenticator creates a new authenticator object

func (*Authenticator) Login added in v1.13.12 

func (a *Authenticator) Login(ctx context.Context, links *Links) error

Login function is used to obtain credentials via stripe dashboard.

type DeviceAuthResponse added in v1.45.3 

type DeviceAuthResponse struct {
	DeviceCode      string `json:"device_code"`
	UserCode        string `json:"user_code"`
	VerificationURI string `json:"verification_uri"`
	ExpiresIn       int    `json:"expires_in"`
	Interval        int    `json:"interval"`
}

DeviceAuthResponse holds the device authorization endpoint response.

func RequestDeviceCode added in v1.45.3 

func RequestDeviceCode(ctx context.Context, accessBaseURL, clientID string) (*DeviceAuthResponse, error)

RequestDeviceCode calls the device authorization endpoint and returns the response. 

type Links struct {
	BrowserURL       string `json:"browser_url"`
	PollURL          string `json:"poll_url"`
	VerificationCode string `json:"verification_code"`
}

Links provides the URLs for the CLI to continue the login flow 

func GetLinks(ctx context.Context, baseURL string, deviceName string, machineUUID string) (*Links, bool, error)

GetLinks provides the URLs for the CLI to continue the login flow.

The machineUUID is sent to the server so it can gate individual machines into the OAuth device-code flow via feature flag. When the server responds with a 3xx, the caller should switch to LoginWithDeviceCode instead of proceeding with the legacy RAK flow; in that case GetLinks returns (nil, true, nil).

type OAuthError added in v1.45.3 

type OAuthError struct {
	Code        string
	Description string
	HTTPStatus  int
}

OAuthError is a structured OAuth error returned by the access-srv token or device-authorization endpoint.

func (*OAuthError) Error added in v1.45.3 

func (e *OAuthError) Error() string

type OAuthTokenResponse added in v1.45.3 

type OAuthTokenResponse struct {
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in"`
	Scope        string `json:"scope"`
}

OAuthTokenResponse holds the token endpoint response.

func PollDeviceToken added in v1.45.3 

func PollDeviceToken(ctx context.Context, accessBaseURL, clientID, deviceCode string, interval time.Duration) (*OAuthTokenResponse, error)

PollDeviceToken polls the token endpoint until the user approves, ctx is canceled or times out, or a terminal error is returned.

Callers should create ctx with a deadline matching DeviceAuthResponse.ExpiresIn to automatically stop polling when the device code expires.

func RefreshAccessToken added in v1.45.3 

func RefreshAccessToken(ctx context.Context, accessBaseURL, clientID, refreshToken string) (*OAuthTokenResponse, error)

RefreshAccessToken exchanges a refresh token for a new access token. On success, callers must persist the returned OAuthTokenResponse.RefreshToken (replacing the previously stored value) before discarding the old token. If the response does not include a refresh token, the caller must require a new interactive login when the access token next expires.

On invalid_grant, callers should clear stored credentials and start a new device authorization flow.

Source Files

View all Source files

Directories

Path Synopsis
Package acct provides Stripe account retrieval during login.
 Package acct provides Stripe account retrieval during login.
Package keys handles API key retrieval and configuration during login.
 Package keys handles API key retrieval and configuration during login.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.