Harden auth flow: prefer qovery api, never let the agent handle tokens - #10
Open
jpetitcolas wants to merge 2 commits into
Open
Harden auth flow: prefer qovery api, never let the agent handle tokens#10jpetitcolas wants to merge 2 commits into
jpetitcolas wants to merge 2 commits into
Conversation
Restructures _shared/auth.md to a 2-tier flow: 1. qovery api — CLI handles auth internally, no token in agent stream 2. $QOVERY_API_TOKEN — fallback when CLI is unavailable Removes the previous token-printing path (qovery auth token --print piped into curl) and the qovery-token-create-by-agent suggestion. When neither tier works, the doc instructs the USER to run `qovery auth` (browser login) or `qovery token create` themselves and export the result — the agent never sees the secret. Synced to all 8 skills via scripts/sync-shared.sh.
…reminder Each phase1 'Authenticate' subsection now points at qovery api as the preferred path and references the auth doc (already loaded via the skill nav) for fallback and not-authenticated cases. Avoids per-skill drift and the chained-reference indirection.
jpetitcolas
marked this pull request as ready for review
May 7, 2026 16:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outcomes
Removes every code path where the agent could see, capture, or generate a Qovery token. Skills now authenticate through the
qoveryCLI, which keeps secrets out of the agent's command stream.User impact:
qovery authwithout any token-creation step.Technical Changes
qovery apias the preferred auth path (CLI handles auth internally — no token in the agent's stream).qovery auth token --printflow that piped the CLI bearer token intocurl.qovery token createsuggestion (its stdout exposes the token).qovery auth(browser login) orqovery token createthemselves.qovery apireminder; full flow stays in_shared/auth.md, synced to all 8 skills.