Use saved hx OAuth session when no API key is provided - #113
Open
shrisukhani wants to merge 4 commits into
Open
Conversation
Fall back to a saved hx OAuth session when no API key is set, refresh tokens against the frontend host, and retry replayable 401s.
Route sandbox control-plane calls through authenticated transport, stop re-reading env after config is resolved, and harden session refresh, lock handling, and ClientConfig compatibility.
Always refresh on 401, cache tokens in memory, run async auth off the event loop, and stop deleting sessions or locks owned by another process.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit fa10ca2. Configure here.
A refresh response that issues a new refresh_token without refresh_token_expires_in no longer inherits the previous token's lifetime. That leftover expiry could make a still-valid session look expired and force another hx auth login. Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
If no API key is set, the client now falls back to a saved
hx auth loginsession so local/dev usage can authenticate without embeddingHYPERBROWSER_API_KEY. API-key auth is unchanged and still wins when provided.Changes
api_key/HYPERBROWSER_API_KEY, or~/.hx_config/auth/<profile>.jsonhttps://app.hyperbrowser.aiorHYPERBROWSER_FRONTEND_URL), with 401 retry for replayable requeststimeout=and the 1.0 TypedDict managersprofile=,HYPERBROWSER_PROFILE, orClientConfig(profile=...)HYPERBROWSER_API_KEYis treated as unset; explicitapi_key=""still errorsClientConfig.from_env()still requires an API keyValidation
ruff check .pytest tests --ignore=tests/sandbox/e2e --ignore=tests/test_typing_contract.py(176 passed)pytest tests/integration(10 passed)mainNote
High Risk
This changes how every control-plane request is authenticated (new OAuth refresh, locks, and 401 retry paths) and relaxes the previous hard requirement for an API key at client construction.
Overview
When no API key is provided, the client can authenticate from a saved
hx auth loginsession at~/.hx_config/auth/<profile>.json, withprofile/HYPERBROWSER_PROFILE/ClientConfig(profile=...). API keys still take precedence;ClientConfig.from_env()still requiresHYPERBROWSER_API_KEY.A new
control_authlayer resolves API key vs OAuth, refreshes tokens against the frontend host (HYPERBROWSER_FRONTEND_URL/ClientConfig(frontend_url=...)), uses file locks for concurrent refresh, and persists updated sessions atomically. Sync/async transports attach auth per request (x-api-keyor Bearer), retry 401 with refresh for replayable calls, and route sandbox control HTTP throughsend_authenticated. Path-based session uploads read bytes up front so OAuth retries can replay the body.Reviewed by Cursor Bugbot for commit 0d60c10. Bugbot is set up for automated code reviews on this repo. Configure here.