[Philipp Koytek (philippkoytek)]

Description

Spike: content-cli sdk token [--json] prints the active profile's access token (refreshed if needed), so a local dev proxy can call Celonis APIs. Tested end to end with sdk-patient-zero.

Not ready to merge:

• No scope for the SDK APIs yet. With content-cli's current scopes, pig-semantic-layer returns 403. The test only passed with the internal ems-frontend client and internal.frontend-dev scope.
• CONTENT_CLI_CLIENT_ID, CONTENT_CLI_SCOPES and CONTENT_CLI_EXTRA_SCOPES env overrides are spike-only. They should be replaced by adding the SDK scope to OAUTH_SCOPES.
• Prints the full-scope profile token, not a short-lived token limited to the requested scope (DISCO-68 asks for 15 min).
• No tests or docs.

Findings, options and recommendation: Local Dev Exploration

Relevant links

• Jira: https://celonis.atlassian.net/browse/DISCO-68

Checklist

• I have self-reviewed this PR
• I have tested the change and proved that it works in different scenarios
• I have updated docs if needed

Co-Authored-By: Claude noreply@anthropic.com
Includes-AI-Code: true

[sonarqubecloud]

Quality Gate failed

Failed conditions
25.0% Coverage on New Code (required ≥ 85%)
5 New Major Issues (required ≤ 0)
1 New Minor Issues (required ≤ 0)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE