Fetching token from a script/process #12852
Replies: 1 comment 1 reply
-
|
Interesting idea! Think there's lots of precedence for this kind of thing, like in your example or https://github.com/docker/docker-credential-helpers, or https://git-scm.com/docs/gitcredentials. So you're imagining something like: And then we we would call that script to grab the token for the current invocation? Any thoughts on the order of precedence if you had |
Beta Was this translation helpful? Give feedback.
-
|
@williammartin yup that's what I'm thinking good question re precedence - from what I've read of all these tools, env vars consistently take higher precedence than a credential helper script. in terms of precedence credential helpers vs. files & keyrings, I don't think there's a universal behavior:
the other implementation detail across all these is how caching and invalid credentials are handled. caching is (from my read) usually to be handled by the credential helper itself, but the credential helper can return cached, but invalid, credentials. the behavior on how that can be handled forks a bit:
I think Git's model may be the most relevant to follow, since implementing credential storage as a helper itself handles precedence and forces designing a credential helper API that 8000 works for the existing use-cases. But, that also implies a not purely additive change. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Hey team, I'm curious if you'd be willing to accept a PR that allows tokens to be fetched from a script rather then having to be pre-configured via environment variables or the other mechanisms.
The use-case is similar to how/why AWS credentials can be generated from a script/process https://docs.aws.amazon.com/sdkref/latest/guide/feature-process-credentials.html - in our case, we have long-lived agentic workflows where the tokens are backed by a Github App, which have the eight hour token expiration. It'd be nice to be able to pull new tokens on-demand from our internal service using this sort of script.
There are workarounds we use today (eg you can do
alias gh='GITHUB_TOKEN=$(get-token) gh', have a cron task that refreshes them regularly, etc), but it would be nice to have this integrated natively.Beta Was this translation helpful? Give feedback.
All reactions