UiPath Automation Cloud uses OAuth 2.0 with the client-credentials grant for confidential External Applications. AURORA mints tokens at runtime — never relies on a stale UIPATH_ACCESS_TOKEN in .env — and writes them back so the uipath CLI and uipath-python SDK both see fresh credentials.
When to invoke
On aurora start boot
Before any call that touches Orchestrator (Sentry, Surgeon, Concierge, Auditor)
When Sentry emits kind: auth_failed
When the cached token's expires_at is within 5 minutes
On 200, writes the token to .env as UIPATH_ACCESS_TOKEN=… (replaces any existing line)
Writes a sidecar at ~/.uipath/aurora-token.json with {access_token, expires_at, scope} for the daemon's in-process cache
On non-200, raises with a clear message — invalid_client, invalid_scope, network — and the corresponding remediation hint
Token refresh strategy
Tokens have expires_in: 3600. AURORA refreshes when now > expires_at - 300s (5-minute buffer). The Conductor's daemon mode (lib/aurora/conductor.py) holds the cache and refreshes opportunistically; agents in Claude Code subagent mode invoke the script directly when needed.
Anti-patterns
Don't paste a curl-test token into UIPATH_ACCESS_TOKEN in .env. Curl-test tokens use a subset of scopes; AURORA requests the full list.
Don't catch and swallow auth errors. Surface them; let Sentry → Diagnostician → Surgeon handle.
Don't store the secret anywhere other than .env. Never log it. The script must redact client_secret from any error trace.
Don't request offline_access for a confidential External App. That's user-scope only.
Required external state
.env populated with UIPATH_URL, UIPATH_CLIENT_ID, UIPATH_CLIENT_SECRET
The External App in Automation Cloud has the scope set granted (verify with the curl in CLAUDE.md)
1---2name: mlbrilliance-uipath-for-coding-agents-aurora-auth3description: aurora-auth4---56# aurora-auth78UiPath Automation Cloud uses OAuth 2.0 with the client-credentials grant for confidential External Applications. AURORA mints tokens at runtime — never relies on a stale `UIPATH_ACCESS_TOKEN` in `.env` — and writes them back so the `uipath` CLI and `uipath-python` SDK both see fresh credentials.910## When to invoke1112- On `aurora start` boot13- Before any call that touches Orchestrator (Sentry, Surgeon, Concierge, Auditor)14- When Sentry emits `kind: auth_failed`15- When the cached token's `expires_at` is within 5 minutes1617## How to use1819```bash20python scripts/mint_token.py [--scopes "OR.Folders OR.Tasks ..."]21```2223If `--scopes` is omitted, reads `policy.yaml::uipath_scopes` and joins with spaces.2425The script:261. Reads `UIPATH_URL`, `UIPATH_CLIENT_ID`, `UIPATH_CLIENT_SECRET` from `.env` (or environment)272. Computes the identity-server endpoint: strips `/orchestrator_` from `UIPATH_URL`, appends `/identity_/connect/token`283. POSTs `grant_type=client_credentials&client_id=…&client_secret=…&scope=…` (form-encoded)294. On 200, writes the token to `.env` as `UIPATH_ACCESS_TOKEN=…` (replaces any existing line)305. Writes a sidecar at `~/.uipath/aurora-token.json` with `{access_token, expires_at, scope}` for the daemon's in-process cache316. On non-200, raises with a clear message — `invalid_client`, `invalid_scope`, network — and the corresponding remediation hint3233## Token refresh strategy3435Tokens have `expires_in: 3600`. AURORA refreshes when `now > expires_at - 300s` (5-minute buffer). The Conductor's daemon mode (`lib/aurora/conductor.py`) holds the cache and refreshes opportunistically; agents in Claude Code subagent mode invoke the script directly when needed.3637## Anti-patterns3839- Don't paste a curl-test token into `UIPATH_ACCESS_TOKEN` in `.env`. Curl-test tokens use a subset of scopes; AURORA requests the full list.40- Don't catch and swallow auth errors. Surface them; let Sentry → Diagnostician → Surgeon handle.41- Don't store the secret anywhere other than `.env`. Never log it. The script must redact `client_secret` from any error trace.42- Don't request `offline_access` for a confidential External App. That's user-scope only.4344## Required external state4546- `.env` populated with `UIPATH_URL`, `UIPATH_CLIENT_ID`, `UIPATH_CLIENT_SECRET`47- The External App in Automation Cloud has the scope set granted (verify with the curl in `CLAUDE.md`)4849---50> Source: [mlbrilliance/uipath-for-coding-agents](https://github.com/mlbrilliance/uipath-for-coding-agents) — distributed by [TomeVault](https://tomevault.io).51<!-- tomevault:4.0:skill_md:2026-06-15 -->
Run npx skillmds@latest add tomevault-io/mlbrilliance-uipath-for-coding-agents-aurora-auth in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
aurora-auth It is listed under Coding & Dev Tools on SkillMD.
This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.
tomevault-io