Auth
Kadaikodi uses Burdenoff Workspaces for identity. All authentication flows are standard OAuth2 on the platform's OIDC provider.
Flows
Device Code (interactive / CLI / extensions)
Best for CLIs, browser extensions, and VS Code — any scenario where the user is present but the client cannot host a redirect URI.
kadaikodi auth login
- CLI requests a device code from the platform
- User opens the verification URL in a browser and enters the code
- User authenticates and authorizes the client
- CLI polls for tokens and receives access + refresh tokens
Authorization Code + PKCE (web apps / mobile)
Best for web and mobile apps that can receive a redirect.
const challenge = sdk.auth.getAuthorizationUrl({
redirectUri: "https://app.kadaikodi.com/callback",
scopes: ["openid", "profile", "email", "offline_access"],
});
// Redirect user to challenge.url
// After redirect back, exchange:
const tokens = await sdk.auth.exchangeAuthCode(code, challenge.codeVerifier, challenge.redirectUri);
Client Credentials (service-to-service / M2M)
Best for backend integrations, cron jobs, and AI agents.
await sdk.auth.authenticateApp(clientId, clientSecret);
Email / Password (SDK only)
Direct sign-in for scripted scenarios.
await sdk.auth.signIn({ username: "[email protected]", password: "secret" });
Tokens
| Token | Purpose | Lifetime | Storage |
|---|---|---|---|
| Access token | Authenticates API calls | ~1 hour | Memory or secure storage |
| Refresh token | Obtains new access tokens | ~30 days | Secure storage (mode 0600) |
| Workspace token | Scopes calls to a workspace | ~15 minutes | Alongside access token |
Required headers
Every GraphQL call must include:
Authorization: Bearer <access-token>
x-workspace-id: <workspace-uuid>
The workspace token is sent automatically by the SDK and CLI when a workspace is selected.
Environment-specific OIDC
| Env | OIDC issuer | Client ID (CLI) |
|---|---|---|
| prod | https://graphql.burdenoff.com/global | burdenoff_cli_kadaikodi |
| alpha | https://alphagraphql.burdenoff.com/global | burdenoff_cli_kadaikodi |
| local | http://localhost:4000/global | burdenoff_cli_kadaikodi |
Override with KADAIKODI_OIDC_ISSUER.