Andrushika opened a new pull request, #76280: URL: https://github.com/apache/airflow/pull/76280
## Why `airflowctl auth login` and `airflowctl auth token` log in with a username and password. Before the command runs, `@provide_api_client` builds the API client with the token stored for the current environment. The command then calls `refresh_base_url` to switch the client to the `--api-url` value. `refresh_base_url` changes only the URL, so the client still adds the stored token to the login request. If the URL has a typo, or points to another server, that server receives the token of the current environment. I checked this on main with a local server that logs the request headers. Both commands sent `Authorization: Bearer <stored token>` to it. ## What Only the `CLI` client adds the bearer token now. The `/auth/token/cli` endpoints of the simple, FAB and Keycloak auth managers read only the username and password from the body, so login works the same. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
