[nicknisi]

Let @workos-inc/authkit-react-router run as a keyless PKCE public client: a server that only needs to sign users in works with WORKOS_CLIENT_ID, WORKOS_REDIRECT_URI and WORKOS_COOKIE_PASSWORD, with no WORKOS_API_KEY. Model the config as a discriminated union (confidential client with an apiKey vs public client without one), so TypeScript makes clear which features need a key. Then demonstrate it working end to end in the React Router example app (/Users/nicknisi/Developer/react-router-authkit-example) running against the local build with no API key, and hand Nick a running demo plus exact steps so he can sign in, see the session load, and see a token refresh succeed.

Riker's check npm run typecheck && npm run lint && npm run prettier && npm test && npm run build passed.

Opened as a draft by Riker (job 55).

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Allows AuthKit to run without an API key, changing authentication mode.

The PR appears safe to merge based on the reviewed changes.

Summary

The PR adds keyless PKCE public-client configuration, retains API-key requirements for feature flags and management calls, and documents and tests callback and refresh behavior.

• The follow-up clarifies that withAuth does not refresh automatically.
• It adds an expired-session authkitLoader test covering refresh credentials and a replacement cookie.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  C[Client configuration] --> K{API key present?}
  K -->|No| P[Public PKCE client]
  K -->|Yes| S[Confidential client]
  P --> A[Sign-in and callback]
  S --> A
  A --> L[Session cookie]
  L --> R[authkitLoader refresh]
  S --> F[Feature flags and management APIs]

Loading

_{Reviews (2) · Last reviewed commit: "test: cover automatic keyless refresh in..."}