{"id":21880755,"url":"https://github.com/maslick/brauzie","last_synced_at":"2025-06-23T17:07:14.044Z","repository":{"id":34985444,"uuid":"194405945","full_name":"maslick/brauzie","owner":"maslick","description":"Awesome CLI tool for fetching JWT tokens for OAuth2.0 clients","archived":false,"fork":false,"pushed_at":"2022-12-10T21:05:45.000Z","size":116,"stargazers_count":15,"open_issues_count":3,"forks_count":3,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-05-19T05:37:38.545Z","etag":null,"topics":["cli","debuging-tool","jwt","k8s","keycloak","kubernetes","nodejs","oauth2","oidc","token"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/maslick.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-06-29T12:57:56.000Z","updated_at":"2025-02-27T23:24:22.000Z","dependencies_parsed_at":"2023-01-15T11:30:37.920Z","dependency_job_id":null,"html_url":"https://github.com/maslick/brauzie","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/maslick/brauzie","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maslick%2Fbrauzie","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maslick%2Fbrauzie/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maslick%2Fbrauzie/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maslick%2Fbrauzie/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/maslick","download_url":"https://codeload.github.com/maslick/brauzie/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/maslick%2Fbrauzie/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":261294501,"owners_count":23136982,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","debuging-tool","jwt","k8s","keycloak","kubernetes","nodejs","oauth2","oidc","token"],"created_at":"2024-11-28T09:15:52.780Z","updated_at":"2025-06-23T17:07:13.960Z","avatar_url":"https://github.com/maslick.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# =brauzie=\n\n[![npm (scoped)](https://img.shields.io/npm/v/@maslick/brauzie.svg)](https://www.npmjs.com/package/@maslick/brauzie)\n[![Build Status](https://travis-ci.org/maslick/brauzie.svg?branch=master)](https://travis-ci.org/maslick/brauzie)\n[![npm download count](https://img.shields.io/npm/dt/@maslick/brauzie.svg)](https://npmcharts.com/compare/@maslick/brauzie?minimal=true)\n[![npm bundle size](https://img.shields.io/badge/size-4kB-green.svg)](https://www.npmjs.com/package/@maslick/brauzie)\n[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)\n\n\nOften times when debugging *security* for your web-applications you need to quickly get the access token from your Identity provider (e.g. Keycloak) and fire a GET/POST request to your backend server using ``curl`` or ``httpie``. Some people use [Postman](https://www.getpostman.com/), some do it manually. Both approaches are time-consuming and nerve-wracking.\n*Brauzie* was designed with an idea of a fast and simple CLI tool for fetching access tokens for Keycloak ``public`` and ``confidential`` clients. It also frees you from the necessity of copy/pasting/decoding your JWT tokens on https://jwt.io. \n\n## Features\n* easy-to-use CLI\n* obtains and decodes JWT tokens\n* support for ``public`` and ``confidential`` client types\n* saves JWT token to ``~/.brauzie/jwt.json``\n* saves identity info about the user to ``~/.brauzie/id-token.json``\n* shows identity info in the browser \n* can be used for k8s authentication (see [here](k8s-authz.md))\n* tested with the latest Keycloak (v5, v6)\n\n## Installation\n```\nnpm i -g @maslick/brauzie\n```\n\n## Usage\n### 1. Authorization Code flow\nFor this to work you will need to register a new ``public`` client in Keycloak.\nThen set your configuration via environment variables:\n```bash\nexport BRAUZIE_KC_URL=https://auth.maslick.ru\nexport BRAUZIE_REALM=brauzie\nexport BRAUZIE_CLIENT_ID=web\n```\n\nThen you can login/logout:\n```bash\nbrauzie login\nbrauzie logout\n```\n\n### 2. Resource Owner Password Credentials Grant flow\nCreate a new or use the existing ``confidential`` client. Make sure to toggle the Direct Access Grants Enabled switch to ``ON``.\nThen set the respective environment variables:\n```bash\nexport BRAUZIE_KC_URL=https://auth.maslick.ru\nexport BRAUZIE_REALM=brauzie\nexport BRAUZIE_CLIENT_ID=oidc-k8s\n\nexport BRAUZIE_CLIENT_SECRET=aaaaa-bbbbb-ccccc-ddddd-eeeee\nexport BRAUZIE_USERNAME=user\nexport BRAUZIE_PASSWORD=password\n```\n\nNow you can login/logout:\n```bash\nbrauzie login --direct-grant\nbrauzie logout\n```\n\n\n## How it works\n*Brauzie* uses the **Authorization Code flow** (see the OAuth2.0 [specs](https://oauth.net/2/grant-types/authorization-code/)).\nAfter you execute the ``login`` command, *Brauzie* will open up a browser window where you will have to login to your OIDC public client with username/password. Then it will exchange the ``authorization_code`` for the JWT token and save it to ``~/.brauzie/jwt.json``:\n```bash\ncat ~/.brauzie/jwt.json\n{\n  \"access_token\": \"xxxxx.yyyyy.zzzzz\",\n  \"expires_in\": 300,\n  \"refresh_expires_in\": 1800,\n  \"refresh_token\": \"zzzzz.yyyyy.xxxxx\",\n  \"token_type\": \"bearer\",\n  \"id_token\": \"aaaaa.bbbbb.ccccc\",\n  \"not-before-policy\": 0,\n  \"session_state\": \"620a5ee7-1596-4669-ac7a-115738f2210c\",\n  \"scope\": \"openid profile email\"\n}\n```\nUnless ``--quite`` is specified, *Brauzie* will output the ``access_token`` to stdout.\nIt will also put the decoded ``id_token`` to ``~/.brauzie/id-token.json``:\n```bash\ncat ~/.brauzie/id-token.json\n{\n  \"jti\": \"fffd0c04-f971-4328-8116-fa4cbabd4978\",\n  \"exp\": 1561839325,\n  \"nbf\": 0,\n  \"iat\": 1561839025,\n  \"iss\": \"https://auth.maslick.ru/auth/realms/brauzie\",\n  \"aud\": \"web\",\n  \"sub\": \"3f6d7531-cf67-4702-a62a-8efcf914d904\",\n  \"typ\": \"ID\",\n  \"azp\": \"web\",\n  \"auth_time\": 1561839025,\n  \"session_state\": \"c298f25b-60ac-4e55-825a-2a66cbfa0cfc\",\n  \"acr\": \"1\",\n  \"email_verified\": true,\n  \"name\": \"Admin Adminović\",\n  \"groups\": [\n    \"/cluster-admins\"\n  ],\n  \"preferred_username\": \"admin\",\n  \"given_name\": \"Admin\",\n  \"family_name\": \"Adminović\",\n  \"email\": \"admin@admin.si\"\n}\n```\n\nLogout will invalidate the current user session and delete the contents of the ``~/.brauzie/`` directory.\n\nFor some applications browser interactions may become a burden (CLI tools, automation scripts, etc.) For this you could utilize the **Direct Access Grants** flow. This requires a Keycloak client of type ``confidential``. Confidential clients are a mix of ``public`` and ``bearer-only``. Just like ``bearer-only`` clients they contain a ``client-secret``, and like ``public`` clients they can issue JWT tokens.\n\nSo instead of using the browser (logging in) you can specify ``BRAUZIE_CLIENT_SECRET``, ``BRAUZIE_USERNAME`` and ``BRAUZIE_PASSWORD`` and just issue:\n```\nbrauzie login --direct-grant\n```\n \n## Advanced usage\n```bash\nexport TOKEN=`brauzie login`\ncurl -H \"Authorization: Bearer $TOKEN\" htts://example.com\n```\n\n```bash\ncat ~/.brauzie | jq -r '.access_token'\ncat ~/.brauzie | jq -r '.refresh_token'\n```\n\n```bash\nTOKEN=$(cat ~/.brauzie/jwt.json | jq -r '.access_token') \nhttp http://httpbin.org/get  \"Authorization: Bearer $TOKEN\"\n```\n\n```bash\necho $(cat ~/.brauzie/id-token.json | jq -r '.name')\n```\n\n## Testing\n* Import [sample-realm.json](sample-realm.json) to your Keycloak instance.\n* Add user/s via Keycloak web console.\n* If you intend to use *Brauzie* for k8s auth/authz, put the user in question to one of the groups: ``cluster-admins`` or ``cluster-users``.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmaslick%2Fbrauzie","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmaslick%2Fbrauzie","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmaslick%2Fbrauzie/lists"}