Module auth 

Provider authentication: the auth.json credential store, OAuth sign-in and refresh, and the interaction a sign-in uses to talk to the user.

Ports of packages/ai/src/auth in pi v1.0.0.

Re-exports

pub use store::CredentialKind;

pub use store::CredentialStore;

Modules

anthropic

Anthropic (Claude Pro/Max) sign-in: Proof Key for Code Exchange (PKCE) with a loopback callback or a copied code. Port of oauth/anthropic.ts.

callback

The loopback server that receives an OAuth redirect, and the race between it and a pasted code. Port of oauth/callback-server.ts and utils/oauth-page.ts.

chatgpt

Sign in with ChatGPT for the openai provider: a public client registered per sign-in, whose user token goes straight to api.openai.com. Port of oauth/openai-chatgpt.ts.

codex

OpenAI Codex (ChatGPT Plus/Pro) sign-in: Proof Key for Code Exchange (PKCE) with a loopback callback, or a device code. Port of oauth/openai-codex.ts.

copilot

GitHub Copilot sign-in: a GitHub device flow, then a Copilot token whose proxy-ep names the account’s API endpoint. Port of oauth/github-copilot.ts.

device

RFC 8628 device authorization polling. Port of oauth/device-code.ts.

federation

Anthropic workload identity federation: exchanges an external OpenID Connect (OIDC) token for a short-lived Anthropic access token and caches it per configuration.

google_adc

Google Application Default Credentials: an access token for Vertex AI from a credentials file.

kimi

Kimi Code (subscription): an RFC 8628 device authorization against auth.kimi.com, whose access token authenticates as a bearer header. Port of oauth/kimi-coding.ts.

lock

Cross-process safety for shared files: a lock compatible with proper-lockfile, which pi uses for auth.json, settings.json and trust.json, and an atomic replacement of a file’s contents. The lock is a <file>.lock directory, and one whose modification time is older than the stale period may be taken over. A lock taken with FileLock::acquire keeps its modification time fresh while held, as proper-lockfile does.

meta

Meta (Muse subscription): an RFC 8628 device authorization against auth.meta.com whose identity token mints a Model API key that lives about a day. The identity token is stored as the refresh token and the key as the access token, so a refresh mints a new key. Port of oauth/meta.ts.

openrouter

OpenRouter OAuth: a Proof Key for Code Exchange (PKCE) sign-in that trades the authorization code for a permanent, user-controlled API key. Port of oauth/openrouter.ts.

pkce

Proof Key for Code Exchange (PKCE, RFC 7636) verifier and S256 challenge. Port of oauth/pkce.ts.

radius

Radius gateway sign-in: a browser Proof Key for Code Exchange (PKCE) flow on a fixed loopback port, or an RFC 8628 device authorization, both against the gateway’s OAuth API. Port of oauth/radius.ts.

store

auth.json: stored credentials keyed by provider id.

xai

xAI (Grok/X subscription): an RFC 8628 device authorization against auth.x.ai. Port of oauth/xai.ts.

Structs

Interaction

The channel between a running sign-in and the UI that serves it.

Link

A labelled link in an info event.

LoginOptions

Installation details some sign-ins need.

OAuthAuth

Credentials derived from an OAuth token for one request.

SelectOption

One choice of a select prompt.

Enums

AuthError

Why a sign-in, refresh or credential change failed.

AuthEvent

Something a sign-in tells the user, deserialized from pi’s AuthEvent JSON.

AuthPrompt

A question a sign-in asks, deserialized from pi’s AuthPrompt JSON.

AuthRequest

A request from a sign-in to the UI.

Traits

KeyAuth

pi-ai’s ApiKeyAuth of a provider an extension implements.

OAuthProvider

An account sign-in: log in, refresh, and derive request credentials.

Functions

builtin_oauth

The built-in sign-in for a provider id, if yapi implements it.

launch

Starts command without terminal input or output, best effort. Returns at once, since the command runs on its own thread.

open_browser

pi’s openBrowser: opens target in the platform browser, best effort and without a shell. Returns at once, since the opener starts on its own thread.

post_form

A POST of fields as a form that accepts JSON, without a timeout.