Bug: M2M example not working at all

[gabrieligbastos]

Prerequisites

• I have searched the repository’s issues and Kinde community to ensure my issue isn’t a duplicate
• I have read the contributing guidelines
• I agree to the terms within the code of conduct

Describe the issue

I was trying to just replicate the simple m2m token. Following the instructions
It was just failing.

That was actually because infra sdk has changed and this example wasnt updated.
So i updated my self, now it is called m2mTokenClaims to be imported.

With that sync error gone, tried the trigger running.
But then fetching:

M2M token generation trigger fired
Workflow found
JavaScript execution started…
Warning
workflow run skipped for the management API token, please remove management API audience from request to be able to run this workflow

Just skipped as is uses an M2M to access kinde API, just as mentioned in the example.
This is a real use case, how would that suppose to be, if i want to enrich my API with info from KindeAPI data return?

Starter kit URL

https://github.com/kinde-starter-kits/workflow-examples/blob/main/m2mToken/mapOrgToM2MApplicationWorkflow.ts

Operating system(s)

macOS

Operating system version(s)

macOS Catalina 10.15.7

Further environment details

Postman issue like:

curl --location 'https://bitbirder-rhinoceros.us.kinde.com/oauth2/token' \
--header 'content-type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=***' \
--data-urlencode 'client_secret=***' \
--data-urlencode 'audience=https://***.us.kinde.com/api'

Reproducible test case URL

just run the example as workflow, fixing the m2mTokenClaims import

Additional information

No response

[ages96]

Hi @gabrieligbastos,

After further review and internal discussion, I’d like to clarify the correct approach for the M2M token generation workflow.

Key Points:
The M2M workflow is designed to augment M2M tokens specifically for calling your own APIs, not the Kinde management API. Tokens intended for the Kinde management API cannot be altered through this process.

Token Request Configuration:
You should initiate the request to the token endpoint using your API audience, not the Kinde management API audience.

Here’s the correct curl command:

curl --location 'https://bitbirder-rhinoceros.us.kinde.com/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=YOUR_CLIENT_ID' \
--data-urlencode 'client_secret=YOUR_CLIENT_SECRET' \
--data-urlencode 'audience=YOUR_API_AUDIENCE'

It is essential to ensure that the audience in the request is for your API and not the Kinde management API.

Workflow Trigger and Execution:
Once the M2M token request for your API is made, it triggers the M2M workflow.

The M2M workflow itself may call the Kinde management API twice, leading to two runtime logs indicating that the workflow was skipped. This behavior is expected and is a result of the security measures in place.

To correctly augment the workflow, you should include claims in your initial API request, following the example:

import { m2mTokenClaims, triggerWorkflow } from '@kinde/infra-sdk';
const token = await getMachineToken({ /* … */ });
const claims = m2mTokenClaims(token);
await triggerWorkflow({ workflowId, token, claims });

For more details, you can refer to the official Kinde documentation on the M2M token generation workflow.

If you have any further questions or need assistance, feel free to reach out.

[gabrieligbastos]

How do I grant the createKindeAPI client inside an M2M workflow the read:application_properties scope? The workflow runs successfully but returns SCOPE_MISSING when trying to fetch application properties