Add `bearer_auth` config toggle for Authorization scheme by williammartin · Pull Request #13400 · cli/cli

williammartin · 2026-05-12T11:58:34Z

Description

Adds a bearer_auth config setting and GH_BEARER_AUTH environment variable to control the Authorization header scheme used in HTTP requests.

When enabled, Authorization: token <TOKEN> becomes Authorization: Bearer <TOKEN>.

Acceptance Test

➜  wm-uber-auth-schema git:(wm-uber-auth-schema) ✗ GH_ACCEPTANCE_HOST=github.com \
   GH_ACCEPTANCE_ORG=gh-acceptance-testing \
   GH_ACCEPTANCE_TOKEN=$(gh auth token) \
   GH_ACCEPTANCE_SCRIPT=bearer-auth.txtar \
   go test -tags=acceptance -count=1 -run ^TestAuth$ ./acceptance
ok  	github.com/cli/cli/v2/acceptance	4.020s

Companion PR

The corresponding go-gh changes for extension support: cli/go-gh#222

Copilot

Pull request overview

Adds a new configuration toggle (bearer_auth) and env var (GH_BEARER_AUTH) to control whether gh uses Authorization: token … (default) or Authorization: Bearer … when attaching auth tokens to HTTP requests, including during login/refresh/status flows.

Changes:

Introduces bearer_auth config option (per-host) and AuthConfig.BearerAuth(host) resolution (env var override + config lookup).
Updates auth-related HTTP requests and transports to emit Bearer when enabled, and threads the toggle through login, refresh, status, and OAuth viewer verification.
Expands tests to cover config/env resolution and Authorization header behavior.

Show a summary per file

File	Description
pkg/cmd/config/list/list_test.go	Updates config listing expectations to include `bearer_auth`.
pkg/cmd/auth/status/status.go	Threads bearer-auth setting into scope lookup during `gh auth status`.
pkg/cmd/auth/shared/oauth_scopes.go	Updates scope-check requests to use the configured Authorization scheme.
pkg/cmd/auth/shared/oauth_scopes_test.go	Adds coverage asserting Bearer Authorization header behavior.
pkg/cmd/auth/shared/login_flow.go	Threads bearer-auth through login flow and centralizes header formatting in helper.
pkg/cmd/auth/refresh/refresh.go	Threads bearer-auth through refresh flow and scope discovery.
pkg/cmd/auth/refresh/refresh_test.go	Updates refresh tests for new AuthFlow signature.
pkg/cmd/auth/login/login.go	Uses bearer-auth setting when validating token and fetching current login.
pkg/cmd/api/api_test.go	Switches some tests to use isolated test config instead of a ConfigMock.
internal/gh/mock/config.go	Extends generated ConfigMock with `BearerAuth` support (but needs import formatting fix).
internal/gh/gh.go	Extends `gh.Config` and `gh.AuthConfig` interfaces to support bearer-auth.
internal/config/stub.go	Ensures config stub forwards `BearerAuth` lookups.
internal/config/config.go	Adds `bearer_auth` config plumbing, defaults, and env/config resolution in `AuthConfig`.
internal/config/auth_config_test.go	Adds tests for `AuthConfig.BearerAuth` behavior (default/global/host/env).
internal/authflow/flow.go	Threads bearer-auth into OAuth viewer lookup used after OAuth flow.
internal/authflow/flow_test.go	Adds test asserting Bearer Authorization header in OAuth viewer lookup.
api/http_client.go	Updates `AddAuthTokenHeader` to select `token` vs `Bearer` per host.
api/http_client_test.go	Adds coverage for Bearer Authorization header in HTTP client transport.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files not reviewed (1)

internal/gh/mock/config.go: Language not supported

Files reviewed: 17/18 changed files
Comments generated: 1

williammartin · 2026-05-13T12:55:09Z

-type tokenGetter interface {
-	ActiveToken(string) (string, string)
-}
+type getTokenFunc func(string) (string, string)


This is cleaning up some code that had obviously become stale when the config used to be provided here.

williammartin · 2026-05-13T12:55:37Z

+
+var falseyValues = []string{"", "0", "false", "no", "disabled", "off"}
+
+func IsTruthy(name string) bool {


This could be used in other places and should have a follow up PR. It's repeated a few times around the codebase.

I also suspect it should maybe go into go-gh to form a consistent basis for any extensions too, but that can be a follow up.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove BearerAuth(hostname string) bool from the AuthConfig interface and implementation. Bearer auth is a general config setting, not an auth-domain concern, so it belongs on Config alongside other settings like browser, editor, and git_protocol. Update cfg.BearerAuth to check the GH_BEARER_AUTH environment variable first, returning a new ConfigEnvironmentProvided source, before falling back to the standard GetOrDefault config resolution. Split the tokenGetter interface in api/http_client.go so it only contains ActiveToken. Bearer auth is now passed as a separate function via HTTPClientOptions.BearerAuth, with nil-safety defaulting to false. Add an acceptance test verifying that GH_DEBUG=api output shows the correct auth scheme (token vs Bearer) based on GH_BEARER_AUTH. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Replace tokenGetter interface with getTokenFunc in HTTPClientOptions - Replace BearerAuth func(string) bool with GetBearerConfig gh.ConfigGetter - Move GH_BEARER_AUTH env var check to shouldUseBearerAuth in api package - Remove unused notice parameter from AuthFlow - Add ConfigGetter type and remove ConfigEnvironmentProvided source Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Replace tinyConfig map type with stubGetToken helper function - Add disabledBearerConfig for test defaults - Remove nil guard on getBearerConfig in shouldUseBearerAuth - All callers now explicitly provide GetBearerConfig Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Export ShouldUseBearerAuth to centralize env var and config checks - Change GetScopes, HasMinimumScopes, GetCurrentLogin to take gh.ConfigGetter - Replace authTokenHeader with authScheme using api.ShouldUseBearerAuth - Update status.go buildEntryOptions to use gh.ConfigGetter - Add acceptance test for auth status with GH_BEARER_AUTH Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add factory HTTP client coverage via gh repo view. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

If getBearerConfig is not provided, default to disabled rather than panicking with a nil pointer dereference. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

williammartin mentioned this pull request May 12, 2026

Add bearer_auth support for extensions cli/go-gh#222

Open

williammartin force-pushed the wm-uber-auth-schema branch 4 times, most recently from 340416f to 937d129 Compare May 12, 2026 12:17

williammartin marked this pull request as ready for review May 12, 2026 12:35

williammartin requested a review from a team as a code owner May 12, 2026 12:35

williammartin requested review from BagToad and Copilot May 12, 2026 12:35

Copilot started reviewing on behalf of williammartin May 12, 2026 12:36 View session

Copilot AI reviewed May 12, 2026

View reviewed changes

Comment thread internal/gh/mock/config.go

williammartin force-pushed the wm-uber-auth-schema branch from 1734423 to 6e63141 Compare May 13, 2026 11:32

williammartin marked this pull request as draft May 13, 2026 11:38

williammartin commented May 13, 2026

View reviewed changes

williammartin marked this pull request as ready for review May 13, 2026 13:40

williammartin and others added 11 commits May 13, 2026 16:03

Add bearer_auth config toggle

0977eb8

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove TODO comment on GetToken nil check

09aa0be

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Move bearer-auth acceptance test under testdata/auth

bed9a82

Add factory HTTP client coverage via gh repo view. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Fix gofmt formatting in status.go

63b18b8

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Document GH_BEARER_AUTH in gh help environment and fix acceptance tests

77bdade

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Test both config and env var for each auth code path

0625d57

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Guard against nil getBearerConfig in ShouldUseBearerAuth

f4b6e8a

If getBearerConfig is not provided, default to disabled rather than panicking with a nil pointer dereference. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

williammartin force-pushed the wm-uber-auth-schema branch from f2c666b to f4b6e8a Compare May 13, 2026 14:03

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add `bearer_auth` config toggle for Authorization scheme#13400

Add `bearer_auth` config toggle for Authorization scheme#13400
williammartin wants to merge 11 commits into
trunkfrom
wm-uber-auth-schema

williammartin commented May 12, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

williammartin May 13, 2026

Uh oh!

williammartin May 13, 2026

Uh oh!

williammartin May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		var falseyValues = []string{"", "0", "false", "no", "disabled", "off"}

		func IsTruthy(name string) bool {

Conversation

williammartin commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Acceptance Test

Companion PR

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

williammartin May 13, 2026

Choose a reason for hiding this comment

Uh oh!

williammartin May 13, 2026

Choose a reason for hiding this comment

Uh oh!

williammartin May 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

williammartin commented May 12, 2026 •

edited

Loading