Authentication
Subscriberbot uses Burdenoff Workspaces identity. All authentication flows are handled through the platform's OAuth2 and token infrastructure.
Supported flows
| Flow | Use case | Client id |
|---|---|---|
| OAuth2 Device Code | Interactive CLI, browser extension, VS Code extension | burdenoff_cli_subscriberbot |
| OAuth2 Authorization Code + PKCE | Web and mobile apps | Varies by app |
| Client Credentials | Service-to-service / M2M / CI automation | Issued per app |
| Email / Password | Direct SDK sign-in | N/A (platform native) |
OAuth2 Device Code
The default flow for CLI, browser extension, VS Code extension, and MCP server:
- The client requests a device code from the global gateway (
/global/oidc/device/code). - The user opens the verification URL and enters the code.
- The client polls
/global/oauth/device/tokenuntil the user completes approval. - The client receives an access token + refresh token pair.
- For workspace-scoped operations, the client calls
issueWorkspaceTokento mint a workspace token.
Workspace queries send both headers:
Authorization: Bearer <platform token>X-Workspace-Authorization: Bearer <workspace token>(browser extension)- Or the workspace token is exchanged internally by the SDK/CLI.
Token storage
| Surface | Storage path | Permissions |
|---|---|---|
| CLI | ~/.config/subscriberbot-cli/auth.json | 0600 |
| Browser extension | chrome.storage.local | Extension-only |
| VS Code extension | VS Code SecretStorage | OS keychain |
| MCP server | ~/.config/subscriberbot-mcp/ | 0600 |
| Node SDK | In-memory or caller-provided | Caller-managed |
| Python SDK | In-memory or caller-provided | Caller-managed |
Token refresh
Platform tokens auto-refresh before expiry (typically every ~1 hour). Workspace tokens are re-issued on workspace switch or as needed by the SDK/CLI. The SDKs support autoRefresh: true by default.
Environment-specific issuers
| Environment | OIDC issuer | Global gateway |
|---|---|---|
| prod (default) | https://graphql.burdenoff.com/global | https://graphql.burdenoff.com/global/graphql |
| alpha | https://alphagraphql.burdenoff.com/global | https://alphagraphql.burdenoff.com/global/graphql |
| local | http://localhost:4000/global | http://localhost:4000/global/graphql |
Override with SUBSCRIBERBOT_OIDC_ISSUER or the equivalent per-product env var.
Managing identity
Profile, MFA, sessions, SSO, and API keys are platform-level concerns managed through Burdenoff Workspaces:
All auth flows target production by default. To authenticate against alpha or local, set BURDENOFF_ENV=alpha|local or pass explicit oidcIssuer / globalEndpoint values. See Environment Selection for endpoint details.