the already-obtained access token
object containing the tokens
Get tokens and store them in State
OptionalforceLoginAsUser: booleantrue to force login as user even if a service account or Amster account is available (default: false)
OptionalautoRefresh: booleantrue to automatically refresh tokens before they expire (default: true)
Optionaltypes: string[]Array of supported deployment types. The function will throw an error if an unsupported type is detected (default: ['classic', 'cloud', 'forgeops'])
OptionalcallbackHandler: CallbackHandlerfunction allowing the library to collect responses from the user through callbacks
OptionaluseDeviceFlow: booleanonly consulted when a loaded connection profile has authMode: 'interactive' — see getTokensInteractive() (default: false)
OptionalpromptHandler: BrowserLoginPromptHandlerrequired only when a loaded connection profile has authMode: 'interactive'; every other auth mode ignores it
OptionalcredentialOverride: "user" | "svcacct" | "amster" | "browser"object containing the tokens
Get tokens via a real interactive browser login (loopback-redirect or
device-authorization grant) instead of a CLI-driven password/service-
account/Amster login. Alongside getTokens(), not a replacement for it.
browser-login options
object containing the tokens
Applies an already-obtained, externally-issued OAuth2 access token to
state, ready for immediate use. UnlikegetTokens()/getTokensInteractive(), this never talks to an authorization endpoint itself — the token was already minted (and, by the caller's own contract, already verified) elsewhere; this only wires it ontostateusing the exact same deployment-type-specific handling a real browser login uses. Intended for hosts that resolve their own caller identity per request (e.g. an MCP server acting as an OAuth2 resource server) rather than performing a login themselves.