Dark-Alex-17/coyote
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

docs: Reordered Clients OAuth docs

Dark-Alex-17
2026-07-21 10:43:35 -06:00
parent fde67da937
commit 07ad1418e0
1 changed files with 13 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Clients.md
+13 -14
@@ -238,15 +238,6 @@ clients:
flow: client_credentials
```
### Providers with Bundled OAuth Defaults
Coyote ships OAuth defaults for the following providers, so you only need `auth: oauth` in your config:
* **xAI:** SuperGrok / X Premium+ subscribers
To bundle defaults for additional providers locally, edit your `models.yaml` (see [Local Models Override](#local-models-override))
and add an `oauth:` block under the provider entry.
### client_credentials Flow
For headless machine-to-machine (M2M) authentication (i.e. no browser, no user interaction), set `flow: client_credentials`
@@ -259,7 +250,7 @@ non-interactive environments.
### Device Authorization Grant (Device Flow, RFC 8628)
For CLIs and headless environments — no browser callback required. Coyote displays a short
For CLIs and headless environments; no browser callback required. Coyote displays a short
`user_code` and a `verification_uri`. You visit the URL on any device (your phone, another
computer, or the same browser Coyote tries to open) and enter the code to approve. Coyote
polls the token endpoint until you approve or the code expires.
@@ -277,9 +268,8 @@ To enable, set `flow: device_code` in your `oauth:` block and provide a `device_
token_url: https://auth.example.com/oauth/token
flow: device_code
**Optional:** some providers require PKCE with device flow (per draft-ietf-oauth-device-flow §5.4).
Set `use_pkce_in_device_flow: true` to opt in — Coyote generates a fresh `code_verifier` and
`code_challenge` (S256) on each authentication.
**Optional:** some providers require PKCE with device flow. Set `use_pkce_in_device_flow: true` to opt
in. Coyote generates a fresh `code_verifier` and `code_challenge` on each authentication.
Token refresh works the same as the Auth Code + PKCE flow: `refresh_token` is silently
exchanged for a new `access_token` when the current one expires.
@@ -287,7 +277,7 @@ exchanged for a new `access_token` when the current one expires.
**Sandbox / headless environments:** when Coyote runs inside a sandbox (`coyote --sandbox`),
your host OAuth tokens (`~/.cache/coyote/oauth/`) are copied into the container so agents can
call OAuth-authenticated providers without re-authenticating. If you do need to authenticate
from inside a sandbox, Device Flow works out of the box — Coyote prints a QR code you can
from inside a sandbox, Device Flow works out of the box: Coyote prints a QR code you can
scan with your phone camera to visit the verification URL. Auth Code + PKCE flows (like xAI's)
generally cannot complete inside a sandbox because they require an inbound callback listener;
authenticate on the host first and let the token copy carry you through.
@@ -301,6 +291,15 @@ overwrite each other's tokens.
To prevent accidental collisions, Coyote now rejects configuration files with duplicate `name` values across all
`clients[]` entries at load time. Fixing the underlying single-namespace layout is future work.
### OpenAI-Compatible Providers with Bundled OAuth Defaults
Coyote ships OAuth defaults for the following providers, so you only need `auth: oauth` in your config:
* **xAI:** SuperGrok / X Premium+ subscribers
To bundle defaults for additional providers locally, edit your `models.yaml` (see [Local Models Override](#local-models-override))
and add an `oauth:` block under the provider entry.
## Providers That Support OAuth
* Claude
* Gemini