# Mlbrilliance Uipath For Coding Agents Aurora Auth

> aurora-auth

- Skill: `tomevault-io/mlbrilliance-uipath-for-coding-agents-aurora-auth` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/mlbrilliance-uipath-for-coding-agents-aurora-auth`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/mlbrilliance-uipath-for-coding-agents-aurora-auth/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/mlbrilliance-uipath-for-coding-agents-aurora-auth

---


# aurora-auth

UiPath Automation Cloud uses OAuth 2.0 with the client-credentials grant for confidential External Applications. AURORA mints tokens at runtime — never relies on a stale `UIPATH_ACCESS_TOKEN` in `.env` — and writes them back so the `uipath` CLI and `uipath-python` SDK both see fresh credentials.

## When to invoke

- On `aurora start` boot
- Before any call that touches Orchestrator (Sentry, Surgeon, Concierge, Auditor)
- When Sentry emits `kind: auth_failed`
- When the cached token's `expires_at` is within 5 minutes

## How to use

```bash
python scripts/mint_token.py [--scopes "OR.Folders OR.Tasks ..."]
```

If `--scopes` is omitted, reads `policy.yaml::uipath_scopes` and joins with spaces.

The script:
1. Reads `UIPATH_URL`, `UIPATH_CLIENT_ID`, `UIPATH_CLIENT_SECRET` from `.env` (or environment)
2. Computes the identity-server endpoint: strips `/orchestrator_` from `UIPATH_URL`, appends `/identity_/connect/token`
3. POSTs `grant_type=client_credentials&client_id=…&client_secret=…&scope=…` (form-encoded)
4. On 200, writes the token to `.env` as `UIPATH_ACCESS_TOKEN=…` (replaces any existing line)
5. Writes a sidecar at `~/.uipath/aurora-token.json` with `{access_token, expires_at, scope}` for the daemon's in-process cache
6. On non-200, raises with a clear message — `invalid_client`, `invalid_scope`, network — and the corresponding remediation hint

## Token refresh strategy

Tokens have `expires_in: 3600`. AURORA refreshes when `now > expires_at - 300s` (5-minute buffer). The Conductor's daemon mode (`lib/aurora/conductor.py`) holds the cache and refreshes opportunistically; agents in Claude Code subagent mode invoke the script directly when needed.

## Anti-patterns

- Don't paste a curl-test token into `UIPATH_ACCESS_TOKEN` in `.env`. Curl-test tokens use a subset of scopes; AURORA requests the full list.
- Don't catch and swallow auth errors. Surface them; let Sentry → Diagnostician → Surgeon handle.
- Don't store the secret anywhere other than `.env`. Never log it. The script must redact `client_secret` from any error trace.
- Don't request `offline_access` for a confidential External App. That's user-scope only.

## Required external state

- `.env` populated with `UIPATH_URL`, `UIPATH_CLIENT_ID`, `UIPATH_CLIENT_SECRET`
- The External App in Automation Cloud has the scope set granted (verify with the curl in `CLAUDE.md`)

---
> Source: [mlbrilliance/uipath-for-coding-agents](https://github.com/mlbrilliance/uipath-for-coding-agents) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-06-15 -->