Fix auth on EU workspaces: preserve Authorization across regional redirect#13
Open
kevduc wants to merge 2 commits into
Open
Fix auth on EU workspaces: preserve Authorization across regional redirect#13kevduc wants to merge 2 commits into
kevduc wants to merge 2 commits into
Conversation
Segment Public API redirects api.segmentapis.com to a regional host (e.g. eu1.api.segmentapis.com) for EU workspaces. URLSession strips Authorization on redirect by default, so the followed request arrives unauthenticated and Segment responds with 401 "Authorization header is required" — surfaced by the CLI as "Supplied token is not authorized." Fix: - Add a URLSessionTaskDelegate that re-attaches Authorization (and Accept) on redirect. - Expose a shared PAPI.session built with that delegate. - Route every PAPI endpoint (auth probe, sources, edge-functions) through PAPI.session instead of URLSession.shared. - Set Accept: application/vnd.segment.v1+json on the auth probe. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Documents the CLI's commands, auth/profile model, EU-workspace behavior (redirect-aware), read-only vs side-effecting commands, and common workflows. Loaded automatically by Claude Code when working in this repo. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
kevduc
force-pushed
the
fix/eu-redirect-auth
branch
from
6b2b226 to
f786dad
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
EU-region Segment workspaces could not authenticate via
segmentcli:authand every subsequent command returnedSupplied token is not authorized.(orAuthorization header is required). Root cause is thatapi.segmentapis.com30x's to a regional host (e.g.eu1.api.segmentapis.com) for EU workspaces, and Apple'sURLSessionstrips theAuthorizationheader on redirect by default — the followed request arrives unauthenticated.This PR adds a
URLSessionTaskDelegatethat re-attachesAuthorization(andAccept) on redirect, exposes a sharedPAPI.sessionbuilt with that delegate, and routes every PAPI endpoint (/,/sources,/sources/<id>/edge-functions/...) through it instead ofURLSession.shared.Also adds a Claude Code skill (
.claude/skills/segmentcli/SKILL.md) documenting the CLI's commands, auth/profile model, and read-only vs side-effecting operations.Commits
PAPIRedirectDelegate,PAPI.session, andAccept: application/vnd.segment.v1+json; routes the auth probe, sources, and edge-functions through the redirect-aware session.Test plan
Tested against an EU workspace:
segmentcli auth <Profile> <Token>— succeeds (previously failed withSupplied token is not authorized.)segmentcli profile list— shows the saved workspacesegmentcli sources list— returns the full source list (previously failed with 401)segmentcli liveplugins latest <sourceId>— authenticates, server reports per-source statesudo make install, release config)No public-facing API or flag changes —
--stagingstill works, no new--euflag (Public API is single-host; the redirect is server-driven).