fix: default the AuthKit issuer to accounts.mukoko.com, not the dead host - #126
Merged
bryanfawcett merged 1 commit intoAug 10, 2026
Merged
Conversation
…host nhimbe's `workosAuthkitDomain()` fell back to `identity.nyuchi.com` when WORKOS_AUTHKIT_DOMAIN was unset. That host was detached by the 10 Aug 2026 issuer migration and now returns Cloudflare error 1014. A default is not harmless here. Every `.well-known` discovery route and /auth.md derives its endpoints from this one function, so whenever the env var is unset nhimbe advertises a dead authorization server to every MCP agent running standard discovery — authorize, token, JWKS and the DCR registration endpoint all pointing at a hostname that no longer resolves. The agent-readiness surface fails silently and from the outside looks like nhimbe's problem. Vercel's fix for nhimbe covered WORKOS_API_HOSTNAME (→ auth.mukoko.com, redeployed). WORKOS_AUTHKIT_DOMAIN was not part of that, which is exactly when this default takes over. Also: - Accept WORKOS_ISSUER as the preferred name, keeping WORKOS_AUTHKIT_DOMAIN as a working alias. The estate spells this value four different ways, which is much of why the migration had to be chased service by service. - CSP connect-src now allows auth.mukoko.com and accounts.mukoko.com and drops the two dead hosts. `https://*.mukoko.com` already covered the new ones, so this was not breaking — but leaving the corpses in an allowlist invites someone to reintroduce them. - Corrected the domain references in proxy.ts and next.config.ts comments, which still described the retired pair as current. 887 tests pass, lint clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HFaeL83iEL5gqQXhHweH6u
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Claude encountered an error —— View job I'll analyze this and get back to you. |
bryanfawcett
marked this pull request as ready for review
August 10, 2026 06:23
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.
Tip: disable this comment in your organization's Code Review settings.
bryanfawcett
deleted the
claude/workos-issuer-migration-accounts-mukoko
branch
August 10, 2026 06:23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The problem
workosAuthkitDomain()fell back toidentity.nyuchi.comwhenWORKOS_AUTHKIT_DOMAINis unset. That host was detached by the 10 Aug 2026 issuer migration and now returns Cloudflare error 1014.A default is not harmless here. Every
.well-knowndiscovery route and/auth.mdderives its endpoints from this one function — so whenever the env var is unset, nhimbe advertises a dead authorization server to every MCP agent running standard discovery:authorize,token,jwksand the DCRregistration_endpointall pointing at a hostname that no longer resolves.The agent-readiness surface fails silently, and from the outside it looks like nhimbe's problem rather than a stale constant.
Vercel's fix for nhimbe covered
WORKOS_API_HOSTNAME(→auth.mukoko.com, redeployed).WORKOS_AUTHKIT_DOMAINwas not part of that — which is precisely the condition under which this default takes over.Changes
accounts.mukoko.com. (accounts, plural —account.mukoko.comis the Mukoko Account app, one character apart.)WORKOS_ISSUERaccepted as the preferred name, withWORKOS_AUTHKIT_DOMAINkept as a working alias. The estate spells this value four ways —WORKOS_AUTHKIT_DOMAIN/WORKOS_ISSUER/WORKOS_AUTHORIZATION_SERVER/AUTHKIT_DOMAIN— which is much of why the migration had to be chased service by service.connect-srcnow allowsauth.mukoko.comandaccounts.mukoko.com, dropping the two dead hosts.https://*.mukoko.comalready covered the new ones so this wasn't breaking — but leaving corpses in an allowlist invites someone to reintroduce them.proxy.ts/next.config.tscomments that still described the retired pair as current.Test plan
npm run test:run— 887 testsnpm run lint— 0 errorsworkos-metadata.test.tsupdated — it pinned the old default, so it would have kept the dead host greenCompanion PRs
Same migration, same branch name:
nyuchi/kweli—fundi-ingestion's wrangler config (patched via API, would revert on next deploy)nyuchi/kweli-mcp— all three new workers hardcoded the dead host🤖 Generated with Claude Code
https://claude.ai/code/session_01HFaeL83iEL5gqQXhHweH6u
Generated by Claude Code