the already-obtained access token
object containing the tokens
Get tokens and store them in State
OptionalforceLoginAsUser: boolean
true to force login as user even if a service account or Amster account is available (default: false)
OptionalautoRefresh: boolean
true to automatically refresh tokens before they expire (default: true)
Optionaltypes: string[]
Array of supported deployment types. The function will throw an error if an unsupported type is detected (default: ['classic', 'cloud', 'forgeops'])
OptionalcallbackHandler: CallbackHandler
function allowing the library to collect responses from the user through callbacks
OptionaluseDeviceFlow: boolean
only consulted when a loaded connection profile prefers browser login (preferredCredential: 'browser', or the legacy authMode: 'interactive' for a profile predating that field) — falls back to the profile's own preferredDeviceFlow when not explicitly passed; see getTokensInteractive() (default: false)
OptionalpromptHandler: BrowserLoginPromptHandler
required only when a loaded connection profile prefers browser login; every other case ignores it
OptionalcredentialOverride: "user" | "svcacct" | "amster" | "browser"object containing the tokens
Get tokens via a real interactive browser login (loopback-redirect or
device-authorization grant) instead of a CLI-driven password/service-
account/Amster login. Alongside getTokens(), not a replacement for it.
browser-login options
object containing the tokens
Applies an already-obtained, externally-issued OAuth2 access token to
state, ready for immediate use. UnlikegetTokens()/getTokensInteractive(), this never talks to an authorization endpoint itself — the token was already minted (and, by the caller's own contract, already verified) elsewhere; this only wires it ontostateusing the exact same deployment-type-specific handling a real browser login uses. Intended for hosts that resolve their own caller identity per request (e.g. an MCP server acting as an OAuth2 resource server) rather than performing a login themselves.