d6e Auth Integration

Overview

Every user-facing call this app makes to the d6e platform — file upload, workflow execution, chat-session CRUD — needs a JWT whose audience matches the d6e instance (${D6E_BASE_URL}). The interactive login still happens at the central d6e-auth server (${D6E_AUTH_URL}), but the authorization code is exchanged at the d6e instance's own token endpoint, which relays it to d6e-auth using the instance's own client credentials and returns a pair already signed for the instance's audience. This skill teaches that instance-brokered Authorization Code flow (no client secret in the frontend), plus a standalone-client alternative for frontends that cannot register a redirect URI on the d6e instance they use.

Companion concepts covered here: