Authentication
TimeCampus uses the Burdenoff platform identity system. All workspace operations require dual-token auth: a platform token (identity) plus a workspace token (data scoping).
Auth flows
OAuth2 Device Code (recommended for CLI and extensions)
Interactive browser-based login. Works on local machines, Remote-SSH, Codespaces, and WSL.
timecampus auth login
- The CLI prints a verification URL and a short user code.
- Open the URL in your browser, enter the code, and approve.
- Tokens are stored locally and auto-refresh before expiry.
Email / Password (SDK only)
import { TimecampusSDK } from '@timecampus/sdk';
const sdk = new TimecampusSDK();
await sdk.auth.signIn({ username: '[email protected]', password: 'secret' });
OAuth2 Authorization Code + PKCE (web apps)
const challenge = sdk.auth.getAuthorizationUrl({
redirectUri: 'http://localhost:8400/callback',
scopes: ['openid', 'profile', 'email', 'offline_access'],
});
// Redirect user to challenge.url, then exchange:
const tokens = await sdk.auth.exchangeAuthCode(code, challenge.codeVerifier, challenge.redirectUri);
Client Credentials (M2M / app auth)
const result = await sdk.auth.authenticateApp(clientId, clientSecret);
Token storage
| Tool | Storage location | Permissions |
|---|---|---|
| CLI | ~/.config/timecampus-cli/auth.json | 0600 |
| VS Code extension | VS Code SecretStorage | Encrypted by VS Code |
| Browser extension | Extension chrome.storage | Browser sandbox |
| MCP server | ~/.config/timecampus-mcp/ | 0o600 |
| Node SDK | In-memory (you provide tokens) | — |
| Python SDK | In-memory (you provide tokens) | — |
Workspace token
After authenticating, issue a workspace-scoped token:
timecampus workspace list
timecampus workspace set <id>
Or programmatically:
const workspaces = await sdk.auth.fetchWorkspaces();
await sdk.auth.issueWorkspaceToken(workspaces[0].id, workspaces[0].organizationId);
Workspace tokens are re-issued automatically when you switch workspaces.
Token refresh
Platform tokens auto-refresh every ~1 hour; workspace tokens every ~15 minutes. Both the CLI and SDKs handle this automatically.
timecampus auth refresh # force refresh
Common auth commands
timecampus auth status # current auth state
timecampus auth token # platform access token
timecampus auth token --workspace # workspace token
timecampus auth refresh # force token refresh
timecampus auth logout # clear stored tokens
Default endpoints (production)
All auth flows target production by default:
- Workspace gateway:
https://graphqlworkspaces.burdenoff.com/workspaces/graphql - Global gateway:
https://graphql.burdenoff.com/global/graphql - OIDC issuer:
https://graphql.burdenoff.com/global
To target a different environment, see Environment selection.