Skip to content

fix(oauth): inject public OAuth defaults #216

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
LorrisSaintGenez merged 1 commit into from
May 12, 2026
Merged

fix(oauth): inject public OAuth defaults #216

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 4 additions & 10 deletions api/dashboard/client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,17 +11,11 @@ import (
"strings"
)

// DefaultDashboardURL and DefaultAPIURL are empty by default and must be
// injected at build time via ldflags, e.g.:
//
// go build -ldflags "-X github.com/algolia/cli/api/dashboard.DefaultDashboardURL=https://..."
//
// They can also be overridden at runtime with ALGOLIA_DASHBOARD_URL / ALGOLIA_API_URL / ALGOLIA_OAUTH_SCOPE
// environment variables.
// Production defaults; overridable via ldflags or ALGOLIA_DASHBOARD_URL / ALGOLIA_API_URL / ALGOLIA_OAUTH_SCOPE env vars.
var (
DefaultDashboardURL = ""
DefaultAPIURL = ""
DefaultOAuthScope = ""
DefaultDashboardURL = "https://dashboard.algolia.com"
DefaultAPIURL = "https://api.dashboard.algolia.com"
DefaultOAuthScope = "public applications:manage keys:manage"
)

// Client interacts with the Algolia Dashboard OAuth endpoint and the Public API.
Expand Down
5 changes: 2 additions & 3 deletions pkg/auth/oauth_flow.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,8 @@
"github.com/algolia/cli/pkg/iostreams"
)

// DefaultOAuthClientID is injected at build time via ldflags.
// Override with ALGOLIA_OAUTH_CLIENT_ID environment variable for local development.
var DefaultOAuthClientID = ""
// DefaultOAuthClientID is a public OAuth client ID (PKCE flow, not a secret).
var DefaultOAuthClientID = "-6xbCNF7usNqkcacFHKt0WHCJIZ2rlp2bP2_VH12xQE"

Check warning on line 14 in pkg/auth/oauth_flow.go

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

pkg/auth/oauth_flow.go#L14 

A gitleaks generic-api-key was detected which attempts to identify hard-coded credentials.

// OAuthClientID returns the OAuth client ID, preferring the ALGOLIA_OAUTH_CLIENT_ID
// environment variable over the compiled-in default (set via ldflags).
Expand Down
Loading