hyperframes auth login's default OAuth flow opens a browser and listens for the callback on http://127.0.0.1:<random-port>/oauth/callback. In headless environments (CI, containers, cloud sandboxes — e.g. a Cloudflare Sandbox driving the CLI via an agent), that flow cannot complete: the user's browser redirects to their loopback, not the machine running the CLI, and no --redirect-uri override exists (auth login --help on 0.7.68 shows only --api-key).
The only working path today is --api-key, which forces long-lived shared keys into exactly the environments where short-lived, scoped, per-user tokens matter most — a sandbox running LLM-authored code.
Proposal: hyperframes auth login --device implementing the OAuth 2.0 Device Authorization Grant (RFC 8628):
- CLI requests a device code, prints the verification URL + user code.
- User approves from any browser on any device.
- CLI polls the token endpoint and stores the credential exactly as the current flow does.
In agent-driven sandboxes the verification code can be surfaced to the user in chat and approved from a phone, yielding per-user HeyGen identity instead of an app-wide key. Requires the HeyGen OAuth app to enable the device grant server-side.
Context: hit while wiring HeyGen-hosted media generation into a HyperFrames authoring studio running the CLI inside Cloudflare Sandbox containers, where auth login prints "Opening browser…" and waits on a loopback callback nothing can ever reach.
hyperframes auth login's default OAuth flow opens a browser and listens for the callback onhttp://127.0.0.1:<random-port>/oauth/callback. In headless environments (CI, containers, cloud sandboxes — e.g. a Cloudflare Sandbox driving the CLI via an agent), that flow cannot complete: the user's browser redirects to their loopback, not the machine running the CLI, and no--redirect-urioverride exists (auth login --helpon 0.7.68 shows only--api-key).The only working path today is
--api-key, which forces long-lived shared keys into exactly the environments where short-lived, scoped, per-user tokens matter most — a sandbox running LLM-authored code.Proposal:
hyperframes auth login --deviceimplementing the OAuth 2.0 Device Authorization Grant (RFC 8628):In agent-driven sandboxes the verification code can be surfaced to the user in chat and approved from a phone, yielding per-user HeyGen identity instead of an app-wide key. Requires the HeyGen OAuth app to enable the device grant server-side.
Context: hit while wiring HeyGen-hosted media generation into a HyperFrames authoring studio running the CLI inside Cloudflare Sandbox containers, where
auth loginprints "Opening browser…" and waits on a loopback callback nothing can ever reach.