From 4ead611680984bee304022d3cb00cc97c6ed4120 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 21 Jul 2026 17:15:55 +0000 Subject: [PATCH 1/2] docs: document CLI generator OAuth 2 client-credentials flow Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .vale/styles/FernStyles/Headings.yml | 1 + fern/products/cli-generator/authentication.mdx | 9 ++++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.vale/styles/FernStyles/Headings.yml b/.vale/styles/FernStyles/Headings.yml index bbbb4a25b5..6f02f4146b 100644 --- a/.vale/styles/FernStyles/Headings.yml +++ b/.vale/styles/FernStyles/Headings.yml @@ -61,6 +61,7 @@ exceptions: - TLS - JWT - OAuth2 + - OAuth 2 - SSO - API - CircleCI diff --git a/fern/products/cli-generator/authentication.mdx b/fern/products/cli-generator/authentication.mdx index 26861173b2..bb4a8ea115 100644 --- a/fern/products/cli-generator/authentication.mdx +++ b/fern/products/cli-generator/authentication.mdx @@ -48,7 +48,14 @@ The CLI supports every scheme type that OpenAPI's `securitySchemes` defines: | Bearer (`http: bearer`) | Sends `Authorization: Bearer `. | | API key (`apiKey`) | Sends the key in the configured header (for example, `X-Auth-Token`). | | Basic (`http: basic`) | Sends `Authorization: Basic `. Each field has its own credential source. | -| OAuth 2 | Treated as bearer — sends `Authorization: Bearer `. | +| OAuth 2 (client credentials) | Runs the [client-credentials grant](#oauth-2-client-credentials): exchanges the client ID and secret for a token, then sends `Authorization: Bearer `. | +| OAuth 2 (other) | Treated as bearer — sends `Authorization: Bearer `. | + +### OAuth 2 client credentials + +When a spec declares an OAuth 2 client-credentials flow, the generated CLI obtains and refreshes tokens itself rather than requiring a pre-obtained bearer token. It reads the client ID and secret from environment variables (`_CLIENT_ID` and `_CLIENT_SECRET` by default, or the names declared in the API definition), exchanges them for an access token at the token endpoint, caches the token, and refreshes it as it nears expiry. + +The flow is generated from the API's OAuth security scheme, including scopes, token headers and prefixes, custom token and refresh requests, and environment URLs. OAuth schemes that aren't client-credentials, or where a token is supplied directly, are treated as bearer. ## Auth strategies From 50edc819f2028e52a3c32b599b860c16ab29a1f2 Mon Sep 17 00:00:00 2001 From: "devin.logan" Date: Wed, 22 Jul 2026 20:09:27 +0000 Subject: [PATCH 2/2] docs: condense OAuth 2 client-credentials into auth scheme table Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .vale/styles/FernStyles/Headings.yml | 1 - fern/products/cli-generator/authentication.mdx | 8 +------- 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/.vale/styles/FernStyles/Headings.yml b/.vale/styles/FernStyles/Headings.yml index 6f02f4146b..bbbb4a25b5 100644 --- a/.vale/styles/FernStyles/Headings.yml +++ b/.vale/styles/FernStyles/Headings.yml @@ -61,7 +61,6 @@ exceptions: - TLS - JWT - OAuth2 - - OAuth 2 - SSO - API - CircleCI diff --git a/fern/products/cli-generator/authentication.mdx b/fern/products/cli-generator/authentication.mdx index bb4a8ea115..c488d53fc7 100644 --- a/fern/products/cli-generator/authentication.mdx +++ b/fern/products/cli-generator/authentication.mdx @@ -48,15 +48,9 @@ The CLI supports every scheme type that OpenAPI's `securitySchemes` defines: | Bearer (`http: bearer`) | Sends `Authorization: Bearer `. | | API key (`apiKey`) | Sends the key in the configured header (for example, `X-Auth-Token`). | | Basic (`http: basic`) | Sends `Authorization: Basic `. Each field has its own credential source. | -| OAuth 2 (client credentials) | Runs the [client-credentials grant](#oauth-2-client-credentials): exchanges the client ID and secret for a token, then sends `Authorization: Bearer `. | +| OAuth 2 (client credentials) | Reads the client ID and secret from `_CLIENT_ID` and `_CLIENT_SECRET` (or the names in the API definition) and fetches the token automatically. | | OAuth 2 (other) | Treated as bearer — sends `Authorization: Bearer `. | -### OAuth 2 client credentials - -When a spec declares an OAuth 2 client-credentials flow, the generated CLI obtains and refreshes tokens itself rather than requiring a pre-obtained bearer token. It reads the client ID and secret from environment variables (`_CLIENT_ID` and `_CLIENT_SECRET` by default, or the names declared in the API definition), exchanges them for an access token at the token endpoint, caches the token, and refreshes it as it nears expiry. - -The flow is generated from the API's OAuth security scheme, including scopes, token headers and prefixes, custom token and refresh requests, and environment URLs. OAuth schemes that aren't client-credentials, or where a token is supplied directly, are treated as bearer. - ## Auth strategies When a spec declares multiple security schemes, the CLI composes them according to one of these strategies: