search

octokit / source-generator

Generates SDKs from GitHub's OpenAPI specification. Built on Kiota.
8 stars 3 forks source link

Support for interactive user authentication. #81

Open gavinbarron opened 1 month ago

gavinbarron commented 1 month ago

It would be really nice if you could provide support for interactive authentication flows in the new Kiota based SDKs.

As a rule Microsoft is moving away from using PATs as part of our ongoing security work. Providing support for end user applications that don't require PATs would be a great benefit to those of us looking to use these SDKs in user contexts.

Ideally, I'd like to see support for the device code flow

nickfloyd commented 1 month ago

Hey @gavinbarron thanks for reaching out. For clarity, the GitHub REST API currently has a few different types of Authentication:

  1. Unauthenticated (some endpoints do not require auth) - currently supported by both generated SDKs
  2. Basic Authentication - currently supported by both generated SDKs
  3. Authenticating with a personal access token (since you mentioned this above, I know this is not what you are referring to) - currently supported by both generated SDKs
  4. Authenticating with a token generated by an app - currently supported by both generated SDKs
  5. GitHub OAuth - NOT supported by either generated SDK.

My guess is that you might be asking about OAuth based workflows. Currently, we do not have any immediate plans implement OAuth flows into the SDKs. The favored approach is to use apps auth instead. The general feeling is that since GitHub Apps uses fine-grained permissions that allows users to have more control over access. Have a read of the differences here between the two and let us know your thoughts.