{"ref":"artifact:saptools-cf-xsuaa","page":"/artifacts/saptools-cf-xsuaa","json":"/artifacts/saptools-cf-xsuaa.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"saptools-cf-xsuaa","name":"@saptools/cf-xsuaa","artifact_type":"cli","ecosystem":"btp","domain":"security-and-compliance","origin_ring":"independent","description":{"one_line":"A command line and [Node.js](external:nodejs) API that reads the XSUAA binding of a [Cloud Foundry](artifact:btp-cloud-foundry-runtime) app and prints an OAuth2 client_credentials token for it, cached until it expires.","short":"OAuth2 token fetcher for a Cloud Foundry app's XSUAA binding","what_it_solves":"Calling a protected endpoint of a deployed app takes the app's own service token, and `cf oauth-token` returns the user's personal UAA token instead. `cf-xsuaa fetch-secret` pulls the client credentials of the app's [XSUAA](artifact:btp-authorization-and-trust-management) binding out of its `VCAP_SERVICES`, and `get-token-cached` prints a valid JWT for the app named by `--region`, `--org`, `--space` and `--app`, refreshing it before it goes stale. Region keys resolve to API endpoints through [@saptools/cf-sync](artifact:saptools-cf-sync), and SAP_EMAIL and SAP_PASSWORD are needed only when the client secret has to be fetched again. Secrets and tokens are kept in `~/.saptools/xsuaa-data.json`. The README names the client_credentials grant and no other."},"links":{"npm":"https://www.npmjs.com/package/@saptools/cf-xsuaa","repo":"https://github.com/dongitran/saptools","docs":"https://github.com/dongitran/saptools/blob/main/packages/cf-xsuaa/README.md"},"identity":{"author":"dongitran","license":"MIT"},"compat":{"deployment":["cf"]},"type_properties":{"distribution":{"value":["npm"],"sources":[{"url":"https://github.com/dongitran/saptools","title":"@saptools/cf-xsuaa — README","checked":"2026-10-18","quote":"npm install -g @saptools/cf-xsuaa"}]}},"provides":[{"capability":"capability:authentication","what_it_does":"Obtains a token for a deployed application rather than for the person at the terminal: it reads that app's XSUAA binding and exchanges its client credentials for a JWT, which it reuses until the token expires. It validates nothing and logs nobody in; the grant it names is client_credentials and no other.","facets":[{"key":"no_user_token","value":true,"source":{"url":"https://raw.githubusercontent.com/dongitran/saptools/main/packages/cf-xsuaa/README.md","title":"dongitran/saptools — packages/cf-xsuaa/README.md","checked":"2026-10-15","quote":"fetches `client_credentials` tokens straight from the XSUAA binding of any CF app"}}],"sources":[{"url":"https://raw.githubusercontent.com/dongitran/saptools/main/packages/cf-xsuaa/README.md","title":"dongitran/saptools — packages/cf-xsuaa/README.md","checked":"2026-10-15","quote":"Fetch XSUAA credentials and OAuth2 access tokens from SAP BTP Cloud Foundry apps"},{"url":"https://raw.githubusercontent.com/dongitran/saptools/main/packages/cf-xsuaa/README.md","title":"dongitran/saptools — packages/cf-xsuaa/README.md","checked":"2026-10-15","quote":"For the first secret fetch, set `SAP_EMAIL` and `SAP_PASSWORD`."}]}],"requires":[{"ref":"artifact:btp-authorization-and-trust-management","for":"The XSUAA binding of the target app, whose client credentials it reads from VCAP_SERVICES and exchanges for a client_credentials token.","requirement":"required","sources":[{"url":"https://github.com/dongitran/saptools/blob/main/packages/cf-xsuaa/README.md","title":"dongitran/saptools — packages/cf-xsuaa/README.md","checked":"2026-10-15","quote":"fetches `client_credentials` tokens straight from the XSUAA binding of any CF app"}]},{"ref":"artifact:saptools-cf-sync","for":"Resolving a region key such as ap10 to its Cloud Foundry API endpoint, so no URL is passed by hand.","requirement":"required","sources":[{"url":"https://github.com/dongitran/saptools/blob/main/packages/cf-xsuaa/README.md","title":"dongitran/saptools — packages/cf-xsuaa/README.md","checked":"2026-10-15","quote":"resolves CF API endpoints from region keys via `@saptools/cf-sync`, no manual URLs"}]},{"ref":"external:nodejs","for":"It is a Node command line and library, and the README names the Node version it needs beside the cf CLI on the PATH.","requirement":"required","sources":[{"url":"https://github.com/dongitran/saptools/blob/main/packages/cf-xsuaa/README.md","title":"dongitran/saptools — packages/cf-xsuaa/README.md","checked":"2026-10-15","quote":"Requires **Node.js ≥ 20** and the **`cf` CLI** on `PATH`."}]}],"provenance":{"discovered_via":[{"source":"source:curator"}],"first_seen":"2026-10-15"},"maintainers":["actor:dong-tran"],"contributors":["actor:dong-tran"],"drafted_with_ai":true,"history":[{"date":"2026-10-15","field":"provides[capability:authentication]","from":"a bare ref","to":"what it does, sources, one property","reason":"On a capability page the edge put a token command line beside an OAuth server and an identity provider with nothing to tell them apart. The edge now says which part of the concern it answers, that it validates nothing, and states the property the BTP door compares on: a token with no user present."}]},"effective_normative_relations":[],"readings":{"liveness":[{"label":"Maintenance","tier":"good","evidence":"2 months since release"},{"label":"Continuity","tier":"fair","evidence":"2 contributors, 1 publisher"},{"label":"Repository","tier":"good","evidence":"pushed 2026-09, not archived"}],"compatibility":[{"label":"Declared for","tier":"unknown","evidence":"no BTP release lines in the atlas"},{"label":"Survived majors","tier":"unknown","evidence":"no BTP release lines in the atlas"},{"label":"Maintainer's CI","tier":"good","evidence":"CodeQL Security Scan green, 2026-09-18"}],"practice":[{"label":"Tests","tier":"good","evidence":"679 test files"},{"label":"Docs","tier":"good","evidence":"docs site, README 8 KB"},{"label":"Changelog","tier":"fair","evidence":"none in the repo"}],"reach":[{"value":15,"unit":"installs/week"},{"value":3,"unit":"watching"}]},"signals":{"crawled_at":"2026-10-26","latest_version":"0.2.1","majors":{"0.1":{"version":"0.1.0","date":"2026-04-18"},"0.2":{"version":"0.2.0","date":"2026-09-02"}},"license":"MIT","first_release":"2026-04-18","last_release":"2026-09-02","releases":13,"cadence_days":1,"maintainers":1,"repository":"git+https://github.com/dongitran/saptools.git","repository_directory":"packages/cf-xsuaa","peer_cds":null,"dependencies":2,"node_engine":">=20.0.0","test_script":false,"types":true,"downloads_weekly":15,"downloads_monthly":135,"stars":3,"forks":0,"open_issues":1,"archived":false,"pushed_at":"2026-09-18","license_spdx":null,"org_owned":false,"default_branch":"main","created_at":"2026-04-03T14:04:40Z","open_prs":1,"tree_truncated":false,"test_files":679,"workflows":33,"other_ci":false,"readme_bytes":8375,"docs_files":0,"changelog":false,"license_file":false,"dts_files":2,"first_commit":"2026-04-18","last_commit":"2026-09-02","commits":18,"contributors":2,"ci_status":"success","ci_run_at":"2026-09-18","ci_workflow":"CodeQL Security Scan","ci_event":"push","readme_path":"packages/cf-xsuaa/README.md","readme_sha":"1332bd87926f281fed488a4dd455a0361472b2fc","months_since_release":2,"dormant":false,"repo_read":"2026-10-26"},"release_notes":{"license":"MIT","quotable":true,"versions":[{"version":"0.2.1","date":"2026-09-02"},{"version":"0.2.0","date":"2026-09-02"},{"version":"0.1.11","date":"2026-06-30"},{"version":"0.1.10","date":"2026-05-03"},{"version":"0.1.9","date":"2026-05-02"},{"version":"0.1.8","date":"2026-05-01"},{"version":"0.1.7","date":"2026-04-29"},{"version":"0.1.6","date":"2026-04-19"},{"version":"0.1.5","date":"2026-04-19"},{"version":"0.1.4","date":"2026-04-18"},{"version":"0.1.3","date":"2026-04-18"},{"version":"0.1.2","date":"2026-04-18"},{"version":"0.1.0","date":"2026-04-18"}],"crawled_at":"2026-10-25"},"edges":{"maintainers":[{"ref":"actor:dong-tran","name":"Đông Trần","json":"/actors/dong-tran.json"}],"contributors":[{"ref":"actor:dong-tran","name":"Đông Trần","json":"/actors/dong-tran.json"}],"explained_by":[],"alternative_to_this":[],"needed_by":[{"ref":"artifact:saptools-bruno","name":"@saptools/bruno","json":"/artifacts/saptools-bruno.json","requirement":"required"}],"available_via":[],"parts":[],"add_ons":[],"answered_through_parts":[]}}