feat: oauth authentication by gabrielmfern · Pull Request #320 · resend/resend-cli

gabrielmfern · 2026-06-05T17:12:16Z

this will only work with the staging api for now, but that's fine. the cleint id is hard coded, and, for consistency, I think we should ensure this exact client id also used in the production oauth client for the CLI

I've verified this does indeed work with the non-sending apis

Summary by cubic

Adds OAuth authentication to the CLI with a browser-based PKCE flow and automatic token refresh. API keys remain supported; the CLI now resolves either an API key or an OAuth grant across commands with improved scope-to-permission handling.

New Features
- resend login: "Login with Resend" opens the browser, runs a local callback server with state verification and timeout, exchanges the code, and saves the grant per profile.
- OAuth grants are stored with access/refresh expiries (access expiry from JWT exp), refreshed automatically, and respect RESEND_BASE_URL; client ID is set in OAUTH_CLIENT_ID.
- Unified resolver resolveAuthentication returns either an API key or an OAuth grant; createClient/requireClient use the right token.
- Permission checks map OAuth scopes (full_access, emails:send) to CLI permissions; error messages refer to "credentials" not just keys.
- whoami and doctor display OAuth details, mask tokens, and skip key-only validation paths; whoami does not refresh expired access tokens.
- When replacing a secure-storage API key with OAuth, the old keychain secret is deleted to avoid shadowing the new grant.
Migration
- No action required; existing API keys keep working.
- The credentials file now stores a type per profile and supports OAuth grants; legacy profiles are read and migrated in memory.
- Secure-storage API keys are removed automatically if overwritten by an OAuth grant.
- To use OAuth, run resend login and choose "Login with Resend".

^{Written for commit 6346679. Summary will update on new commits.}

Signed-off-by: Gabriel Miranda <gabrielmfern@outlook.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Signed-off-by: Gabriel Miranda <gabrielmfern@outlook.com>

cubic-dev-ai

0 issues found across 6 files (changes from recent commits).

_{Requires human review: This PR introduces a new OAuth authentication flow with PKCE, token refresh, and credential migration across multiple commands and core libraries, which is a high-risk change to critical authentication logic that requires human review for security, correctness, and integration with existing API key

Re-trigger cubic}

cubic-dev-ai

7 issues found

_{Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic}

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

_{Requires human review: Auto-approval blocked by 6 unresolved issues from previous reviews.

Re-trigger cubic}

Signed-off-by: Gabriel Miranda <gabrielmfern@outlook.com>

felipefreitag · 2026-06-05T17:41:17Z

+export const OAUTH_CLIENT_ID = '7136aa0b-625c-4c9c-8820-e9784c8eb141';
+
+export function getJwtExp(token: string): number {
+  const payload = token.split('.')[1];


I think it would be safer to validate the token structure here and throw in case there's anything wrong with it, otherwise users will have inconsistent states later

Signed-off-by: Gabriel Miranda <gabrielmfern@outlook.com>

felipefreitag · 2026-06-05T17:43:57Z

    }
+    if (entry?.type === 'oauth_grant') {
+      const { access_token, scope } = await refreshOAuthGrant(entry, profile);
+      return { type: 'oauth_grant', access_token, profile, scope };


What happens if this fails, i.e. the user is logged out?
doctor and whoami call this, there's no error handling, so if I understood correctly, a user checking their expired auth would get unhandled errors instead of a message to login

felipefreitag · 2026-06-05T17:44:52Z

    const globalOpts = cmd.optsWithGlobals() as GlobalOpts;
    const profileFlag = globalOpts.profile;
-    const resolved = await resolveApiKeyAsync(globalOpts.apiKey, profileFlag);
+    const resolved = await resolveAuthentication(


whoami's help message says it's a local command, but now it hits the network, we should clear that - or not call the actual auth here at all.

added a treatment for that, can you check again?

Signed-off-by: Gabriel Miranda <gabrielmfern@outlook.com>

felipefreitag · 2026-06-05T17:46:28Z

+
+    const updatedProfiles = {
+      ...creds.profiles,
+      [profile]: { type: 'oauth_grant' as const, ...grant },


the plain text credentials file is just supposed to store references for the name the user chose for their profile and the secure storage data; we shouldn't store the grand in plain text, it should go to secure storage

felipefreitag · 2026-06-05T17:47:55Z


+function migrateRawProfile(raw: Record<string, unknown>): Profile {
+  if (raw.type === 'oauth_grant') {
+    return raw as OAuthGrant;


this is plain text; maybe we should validate this format here?

felipefreitag · 2026-06-05T17:49:47Z

+    );
+  }
+
+  const data = (await response.json()) as {


is it possible to have response.ok AND not have a valid token here? wondering if we should validate the schema to be safe

felipefreitag · 2026-06-05T17:51:29Z

+      res.end(
+        '<!doctype html><html><head><title>Resend CLI</title></head>' +
+          '<body style="font-family:system-ui;text-align:center;padding:2rem">' +
+          '<h2>Authentication complete</h2>' +


should we always choose "authentication complete" regardless of the code/state/error?

cubic-dev-ai

2 issues found across 5 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/lib/oauth.ts">

<violation number="1" location="src/lib/oauth.ts:59">
P2: Unconditionally using `refresh_token_expires_in` can persist `NaN` and break refresh-expiry handling when the field is omitted.</violation>
</file>

<file name="src/lib/config.ts">

<violation number="1" location="src/lib/config.ts:543">
P2: This delete assumes every `api_key` profile in a `secure_storage` file has a keychain secret, so OAuth login can fail for preserved file-backed profiles.</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic}

cubic-dev-ai · 2026-06-05T17:54:39Z

+  };
+
+  const newAccessTokenExpiresAt = getJwtExp(data.access_token);
+  const newRefreshTokenExpiresAt = nowSeconds + data.refresh_token_expires_in;


P2: Unconditionally using refresh_token_expires_in can persist NaN and break refresh-expiry handling when the field is omitted.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/lib/oauth.ts, line 59: <comment>Unconditionally using `refresh_token_expires_in` can persist `NaN` and break refresh-expiry handling when the field is omitted.</comment> <file context> @@ -52,13 +52,11 @@ export async function refreshOAuthGrant( - const newRefreshTokenExpiresAt = data.refresh_token_expires_in - ? nowSeconds + data.refresh_token_expires_in - : grant.refresh_token_expires_at; + const newRefreshTokenExpiresAt = nowSeconds + data.refresh_token_expires_in; await storeOAuthGrant( </file context>

cubic-dev-ai · 2026-06-05T17:54:39Z

+    ) {
+      const backend = await getCredentialBackend();
+      if (backend.isSecure) {
+        const deleted = await backend.delete(SERVICE_NAME, profile);


P2: This delete assumes every api_key profile in a secure_storage file has a keychain secret, so OAuth login can fail for preserved file-backed profiles.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/lib/config.ts, line 543: <comment>This delete assumes every `api_key` profile in a `secure_storage` file has a keychain secret, so OAuth login can fail for preserved file-backed profiles.</comment> <file context> @@ -522,6 +531,24 @@ export async function storeOAuthGrant( + ) { + const backend = await getCredentialBackend(); + if (backend.isSecure) { + const deleted = await backend.delete(SERVICE_NAME, profile); + if (!deleted) { + throw new Error( </file context>

felipefreitag · 2026-06-05T18:35:29Z

+  }
+
+  const baseUrl = process.env.RESEND_BASE_URL ?? 'https://api.resend.com';
+  const response = await fetch(`${baseUrl}/oauth/token`, {


Our other direct fetch calls use AbortSignal.timeout to prevent them from hanging?
I mean adding them to every fetch call added here.
For example

let response: Response; try { response = await fetch(`${baseUrl}/oauth/token`, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ grant_type: 'refresh_token', client_id: OAUTH_CLIENT_ID, refresh_token: grant.refresh_token, }), signal: AbortSignal.timeout(30_000), }); } catch (err) { if (err instanceof Error && err.name === 'TimeoutError') { throw new Error( 'Token refresh timed out after 30s. Check your connection and try again.', ); } throw new Error( 'Could not reach the Resend API to refresh your session. Check your connection and try again.', ); } if (!response.ok) { throw new Error( `Token refresh failed (${response.status}). Please run \`resend login\` again.`, ); }

gabrielmfern and others added 6 commits June 5, 2026 12:44

change how we store credentials to also support storing the oauth grant

e427c86

Signed-off-by: Gabriel Miranda <gabrielmfern@outlook.com>

add support for resolving the oauth grant as well as the api key

b2b21fa

Signed-off-by: Gabriel Miranda <gabrielmfern@outlook.com>

add proper login with oauth

a2940ab

Signed-off-by: Gabriel Miranda <gabrielmfern@outlook.com>

ensure server is closed once auth is done

5f5318e

Signed-off-by: Gabriel Miranda <gabrielmfern@outlook.com>

use RESEND_BASE_URL env var for OAuth instead of hardcoded URL

42f623b

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix doctor showing error when using an oauth grant

b8ac782

Signed-off-by: Gabriel Miranda <gabrielmfern@outlook.com>

gabrielmfern requested a review from felipefreitag June 5, 2026 17:12

lint

de23f8f

Signed-off-by: Gabriel Miranda <gabrielmfern@outlook.com>

cubic-dev-ai Bot reviewed Jun 5, 2026

View reviewed changes

Comment thread src/lib/oauth.ts

Comment thread src/lib/config.ts

Comment thread src/lib/client.ts Outdated

Comment thread src/lib/oauth.ts

Comment thread src/commands/whoami.ts

Comment thread src/commands/auth/login.ts Outdated

Comment thread src/commands/auth/login.ts Outdated

avoid nullish check

1230429

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

cubic-dev-ai Bot reviewed Jun 5, 2026

View reviewed changes

gabrielmfern added 2 commits June 5, 2026 14:39

assume refresh token expiry time is always returned

b4b774c

Signed-off-by: Gabriel Miranda <gabrielmfern@outlook.com>

don't refresh expired access token in whoami command

4b64a81

Signed-off-by: Gabriel Miranda <gabrielmfern@outlook.com>

felipefreitag reviewed Jun 5, 2026

View reviewed changes

improve scope treatment for oauth

4d68cdd

Signed-off-by: Gabriel Miranda <gabrielmfern@outlook.com>

felipefreitag reviewed Jun 5, 2026

View reviewed changes

ensure deletion of overwritten secure credential

6346679

Signed-off-by: Gabriel Miranda <gabrielmfern@outlook.com>

felipefreitag reviewed Jun 5, 2026

View reviewed changes

cubic-dev-ai Bot reviewed Jun 5, 2026

View reviewed changes

felipefreitag reviewed Jun 5, 2026

View reviewed changes

Conversation

gabrielmfern commented Jun 5, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

gabrielmfern commented Jun 5, 2026 •

edited by cubic-dev-ai Bot

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot Jun 5, 2026 •

edited

Loading

cubic-dev-ai Bot Jun 5, 2026 •

edited

Loading