How do I use the token to authenticate with Heroku in Ruby using their gem?

Question

I can successfully list pipelines using the heroku-cli (actual names hidden for security):

$ heroku pipelines
=== My Pipelines
...-qa-pipeline
...-qa-pipeline
...-qa-pipeline

When I try to do the same in Ruby, I get a 401 Unauthorized:

require "platform-api"
heroku = PlatformAPI.connect_token(`heroku auth:token`.strip)
heroku.pipeline.list

This results in:

/home/pupeno/.rbenv/versions/3.1.2/lib/ruby/gems/3.1.0/gems/excon-0.99.0/lib/excon/middlewares/expects.rb:13:in `response_call': Expected([200, 201, 202, 204, 206, 304, 429]) <=> Actual(401 Unauthorized) (Excon::Error::Unauthorized)
        from /home/pupeno/.rbenv/versions/3.1.2/lib/ruby/gems/3.1.0/gems/excon-0.99.0/lib/excon/middlewares/response_parser.rb:12:in `response_call'                                                                                    
        from /home/pupeno/.rbenv/versions/3.1.2/lib/ruby/gems/3.1.0/gems/excon-0.99.0/lib/excon/connection.rb:459:in `response'                                                                                                         
        from /home/pupeno/.rbenv/versions/3.1.2/lib/ruby/gems/3.1.0/gems/excon-0.99.0/lib/excon/connection.rb:290:in `request'                                                                                                          
        from /home/pupeno/.rbenv/versions/3.1.2/lib/ruby/gems/3.1.0/gems/heroics-0.1.2/lib/heroics/link.rb:118:in `block in request_with_cache'                                                                                         
        from /home/pupeno/.rbenv/versions/3.1.2/lib/ruby/gems/3.1.0/gems/rate_throttle_client-0.1.2/lib/rate_throttle_client/clients/exponential_increase_proportional_remaining_decrease.rb:17:in `call'                               
        from /home/pupeno/.rbenv/versions/3.1.2/lib/ruby/gems/3.1.0/gems/heroics-0.1.2/lib/heroics/link.rb:117:in `request_with_cache'                                                                                                  
        from /home/pupeno/.rbenv/versions/3.1.2/lib/ruby/gems/3.1.0/gems/heroics-0.1.2/lib/heroics/link.rb:68:in `run'                                                                                                                  
        from /home/pupeno/.rbenv/versions/3.1.2/lib/ruby/gems/3.1.0/gems/heroics-0.1.2/lib/heroics/resource.rb:28:in `method_missing'                                                                                                   
        from /home/pupeno/.rbenv/versions/3.1.2/lib/ruby/gems/3.1.0/gems/platform-api-3.5.0/lib/platform-api/client.rb:2610:in `list'                                                                                                   
        from (irb):3:in `<main>'

What am I missing here?

Have you confirmed that `\`heroku auth:token\`` returns what you expect it to return? This seems like a very odd way of going about this. Is there a reason you don't just configure this as an [environment variable](https://devcenter.heroku.com/articles/config-vars) instead? — engineersmnky, May 17 '23 at 14:56
@engineersmnky I don't know how to confirm it, it's on opaque token. It is the same token as in `~/.netrc` in case that was the question. I don't want to require the users to have to set up an environment variable before they can run this command, it'll reduce the convenience of running a command to begin with. — Pablo Fernandez, May 17 '23 at 15:13
I am not certain exactly what you are saying but you should be able to call `puts \`heroku auth:token\`.strip` to see the output. If you can't verify the token is correct or visible then ruby can't either. Right now your issue is the call fails Authorization (thus the 401) which to me suggests that you are not passing the correct token value. — engineersmnky, May 17 '23 at 15:18
@engineersmnky well, that's probably the core of my question. Yes, I have looked at the output of `heroku auth:token` and it is correct and it is the same token that's in `~/.netrc` where heroku's cli writes and reads it from, and where curl can read it from as well. That doesn't necessarily mean it's the token that `connect_token` expects though. — Pablo Fernandez, May 17 '23 at 15:25
Have you tried using it manually? Have you tried the other connection methods e.g. `connect`? — engineersmnky, May 17 '23 at 15:50
@engineersmnky I don't know how to use _manually_. I just tried it with the `connect` and it worked... grrr. I'm sure I tried that already, but clearly I was doing something different at that point. Thank you. — Pablo Fernandez, May 17 '23 at 15:56
Have you tried `PlatformAPI.connect_oauth`? (The only difference between `connect_token` and `connect_oauth` seems to be the `Authorization` header is set as `Token` instead of `Bearer`) — Arctodus, May 17 '23 at 15:59
@Arctodus what `heroku auth:token` gives you is not an OAuth token. I didn't try it, but I wouldn't expect that to work. — Pablo Fernandez, May 18 '23 at 09:31
@engineersmnky do you want to add the answer for the reputation or shall I do it myself? Happy either way. — Pablo Fernandez, May 18 '23 at 09:32
@pupeno feel free to answer your own question. I have no experience with this library, simply looked through the source and took a shot in the dark (thus the comment and not an answer). — engineersmnky, May 19 '23 at 01:49

score 0 · Answer 1 · answered May 19 '23 at 14:22

Instead of

heroku = PlatformAPI.connect_token(`heroku auth:token`.strip)

I used

heroku = PlatformAPI.connect(`heroku auth:token`.strip)

which worked. Apparently what heroku auth:token gives you is not a token but an api key: http://heroku.github.io/platform-api/PlatformAPI.html#connect-class_method

How do I use the token to authenticate with Heroku in Ruby using their gem?

1 Answers1