fix: update relevant doc pages with improved instructions#733
Open
tamalchowdhury wants to merge 3 commits into
Open
fix: update relevant doc pages with improved instructions#733tamalchowdhury wants to merge 3 commits into
tamalchowdhury wants to merge 3 commits into
Conversation
Contributor
WalkthroughThree documentation pages are updated to modernize guidance on API credentials: client secret rotation now emphasizes immediate deactivation and adds a paid "maintain previous secret" option; the app keys guide introduces credential definitions and FAQs covering rotation and secure storage; and the API key troubleshooting guide refreshes error categories, adds code examples for seven solution paths, and appends best-practice prevention guidance. ChangesAPI Credentials Documentation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying kinde-docs-preview with
|
| Latest commit: |
7086252
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://bbfcbf8b.kinde-docs-preview.pages.dev |
| Branch Preview URL: | https://tamal-update-trending-pages.kinde-docs-preview.pages.dev |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/content/docs/build/applications/rotate-client-secret.mdx`:
- Line 37: The phrase "Kinde-side application" in the documentation line inside
rotate-client-secret.mdx is awkward and non-standard; replace it with clearer
wording such as "your application in Kinde", "the application configuration in
Kinde", or "the Kinde-hosted application" wherever "Kinde-side application"
appears (e.g., the sentence beginning "To ensure your applications remain
secure...") so the text reads naturally and consistently.
In
`@src/content/docs/manage-your-apis/troubleshoot-api-keys/common-api-key-errors.mdx`:
- Around line 125-136: The token endpoint examples use an incorrect
Authorization header and a single apiKey; update each example (notably the
function getValidToken(apiKey) and the other token-refresh snippets in the
"Token expired" section) to accept clientId and clientSecret parameters instead
of apiKey, remove the Authorization header, and include client_id and
client_secret as URL-encoded form fields in the POST body alongside
grant_type=client_credentials and scope; ensure the Content-Type remains
application/x-www-form-urlencoded and that the body concatenates client_id,
client_secret, grant_type, and scope for the /oauth2/token requests.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 18a33706-f95f-4df1-8cf1-ee8e72e9e70e
📒 Files selected for processing (3)
src/content/docs/build/applications/rotate-client-secret.mdxsrc/content/docs/get-started/connect/getting-app-keys.mdxsrc/content/docs/manage-your-apis/troubleshoot-api-keys/common-api-key-errors.mdx
| --- | ||
|
|
||
| To ensure your applications remain secure, you can periodically rotate the Client secret stored in the Kinde-side application. | ||
| To ensure your applications remain secure, you can periodically rotate the client secret stored in the Kinde-side application. |
Contributor
There was a problem hiding this comment.
Rephrase awkward terminology.
The term "Kinde-side application" is non-standard and awkward. Consider rephrasing for better clarity.
✍️ Suggested rephrase
-To ensure your applications remain secure, you can periodically rotate the client secret stored in the Kinde-side application.
+To ensure your applications remain secure, you can periodically rotate the client secret stored in Kinde for your application.or alternatively:
-To ensure your applications remain secure, you can periodically rotate the client secret stored in the Kinde-side application.
+To ensure your applications remain secure, you can periodically rotate the client secret for your application in Kinde.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| To ensure your applications remain secure, you can periodically rotate the client secret stored in the Kinde-side application. | |
| To ensure your applications remain secure, you can periodically rotate the client secret stored in Kinde for your application. |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/content/docs/build/applications/rotate-client-secret.mdx` at line 37, The
phrase "Kinde-side application" in the documentation line inside
rotate-client-secret.mdx is awkward and non-standard; replace it with clearer
wording such as "your application in Kinde", "the application configuration in
Kinde", or "the Kinde-hosted application" wherever "Kinde-side application"
appears (e.g., the sentence beginning "To ensure your applications remain
secure...") so the text reads naturally and consistently.
Comment on lines
+125
to
+136
| 1. Implement token refresh logic | ||
| ```javascript | ||
| async function getValidToken(apiKey) { | ||
| try { | ||
| const response = await fetch("https://your-domain.kinde.com/oauth2/token", { | ||
| method: "POST", | ||
| headers: { | ||
| "Content-Type": "application/x-www-form-urlencoded", | ||
| Authorization: `Bearer ${apiKey}` | ||
| }, | ||
| body: "grant_type=client_credentials&scope=openid profile" | ||
| }); |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether this doc pattern is unique or repeated elsewhere.
# Expected: find all oauth2/token examples using Bearer apiKey to align/fix consistently.
rg -n -C3 'oauth2/token|Authorization:\s*`Bearer\s*\$\{apiKey\}`|grant_type=client_credentials' --type=md --type=mdxRepository: kinde-oss/documentation
Length of output: 95
🏁 Script executed:
# Read the target file to see the actual content
cat -n src/content/docs/manage-your-apis/troubleshoot-api-keys/common-api-key-errors.mdx | sed -n '120,160p'Repository: kinde-oss/documentation
Length of output: 1506
🏁 Script executed:
# Search for oauth2/token patterns across markdown and MDX files without type constraints
rg -n -C3 'oauth2/token' --glob='*.md' --glob='*.mdx'Repository: kinde-oss/documentation
Length of output: 41670
🏁 Script executed:
# Search for Bearer apiKey pattern specifically
rg -n 'Authorization.*Bearer.*apiKey' --glob='*.md' --glob='*.mdx' -C2Repository: kinde-oss/documentation
Length of output: 2401
🏁 Script executed:
# Look for other token refresh or getValidToken examples
rg -n 'getValidToken|grant_type.*client_credentials' --glob='*.md' --glob='*.mdx' -C3Repository: kinde-oss/documentation
Length of output: 24028
Token endpoint authentication method is incorrect across multiple examples.
Lines 125–136, 146–155, and 181–200 show Authorization: Bearer ${apiKey} for requests to /oauth2/token with grant_type=client_credentials. This pattern will fail and is inconsistent with Kinde's and OAuth 2.0 specifications.
The client credentials flow requires passing client_id and client_secret in the request body. Update all examples in this section to:
- Accept
clientIdandclientSecretparameters instead of a singleapiKey - Remove the
Authorizationheader - Include
client_idandclient_secretas form data parameters in the body (alongsidegrant_typeandscope)
This affects at least three code examples in the "Token expired" solution section.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@src/content/docs/manage-your-apis/troubleshoot-api-keys/common-api-key-errors.mdx`
around lines 125 - 136, The token endpoint examples use an incorrect
Authorization header and a single apiKey; update each example (notably the
function getValidToken(apiKey) and the other token-refresh snippets in the
"Token expired" section) to accept clientId and clientSecret parameters instead
of apiKey, remove the Authorization header, and include client_id and
client_secret as URL-encoded form fields in the POST body alongside
grant_type=client_credentials and scope; ensure the Content-Type remains
application/x-www-form-urlencoded and that the body concatenates client_id,
client_secret, grant_type, and scope for the /oauth2/token requests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR improves 3 new doc changes. The following pages are updated with better content, instructions, and ai_summary:
Summary by CodeRabbit