d6e Auth Integration

Overview

Every user-facing call this app makes to the d6e platform — file upload, workflow execution, chat-session CRUD — needs a JWT issued by the d6e instance (${D6E_BASE_URL}). Logins, however, happen at the central d6e-auth server (${D6E_AUTH_URL}), whose tokens carry iss=d6e-auth and are rejected by the d6e instance's audience check with a 401. This skill teaches the OAuth2 Authorization Code flow plus the mandatory second exchange that re-mints the d6e-auth refresh token at the d6e instance so every Bearer call against the d6e instance API succeeds.

Companion concepts covered here: