[mishushakov]

Summary

The CLI now authenticates every request with the login's OAuth access token instead of the project API key it used to store in ~/.e2b/config.json. It refreshes the token automatically, including during long-running commands and across concurrent e2b processes. E2B_API_KEY still works and wins, for CI/CD. Needs #2102 (merged 2026-11-10); docs in e2b-dev/docs#636.

Bottom of stack #2115: #2103 → #2104 → #2105 → #2124 → #2125; each PR merges into the one below.

Changes

1. Login URL. e2b auth login opens https://e2b.dev/auth/cli (https://$E2B_DOMAIN/auth/cli when set). DOCS_BASE and the E2B_DOCS_BASE override are removed. Both the old e2b.dev/docs/api/cli and the new URL already 308 to console.e2b.dev/auth/cli, so the browser flow itself is unchanged.

2. Automatic refresh. ensureAuth() replaces ensureAPIKey() everywhere:

const auth = await ensureAuth() // { apiKey } from E2B_API_KEY, else:
// { apiHeaders: { Authorization: 'Bearer <access token>', 'X-Team-ID': <project> } }
await Sandbox.list({ ...auth })

• Tokens are refreshed when they expire within a minute; they live one hour.
• Refresh tokens rotate, and the old one is rejected once used. Before, two commands refreshing at the same time could get invalid_grant, which deletes the config and signs the user out. Refreshes are now serialized with a lock on the config (~/.e2b/config.json.lock, managed by proper-lockfile: kept fresh while held, released on process exit, taken over once stale after 30 s), through a generic withFileLock(path, fn, { staleMs, timeoutMs }) in src/utils/lock.ts that feat(cli): pick projects from workspace-api, route to each project's plane #2104 also uses for project changes. The config is re-read under the lock, so a process that waited reuses the tokens the other one just wrote. A lock lost mid-refresh (the holder stalled past the stale window) prints a warning instead of crashing the command.
• Credentials are resolved per request, not per command. sandbox logs --follow, sandbox metrics --follow and the attached sandbox create keepalive (now the static Sandbox.setTimeout, not the instance method that kept the original token) keep working past an hour.
• e2b auth configure re-reads the config before saving the selected project. Before, it wrote back the tokens it had read before its prompt, which undid any refresh another process made while the prompt was open.
• Config writes are atomic (temp file + rename), since refreshes now write in the background of any command.

3. The stored API key plays no role.

• Login and configure don't write projectApiKey, and nothing reads it. The schema and the v1 → v2 migration don't know the field: a key an earlier version stored is carried through writes untouched, like any field this version doesn't know about, but the CLI makes no promise about it.
• The project for each request comes from --project, then E2B_PROJECT_ID / E2B_TEAM_ID, then the configured project. So template list --project now selects the project for logged-in users too.

$ e2b auth login                                  # opens https://e2b.dev/auth/cli
$ e2b sandbox list                                # Bearer <access token> + X-Team-ID: <selected project>
$ E2B_PROJECT_ID=<other> e2b template list        # one-off project override
$ E2B_API_KEY=e2b_... e2b template create my-tpl  # CI: API key, no login needed

Notes for review

• Downgrades. Released CLIs require projectApiKey in a v2 config. After a fresh login with this version there is none, so an older CLI reports the deprecated-config message and asks for e2b auth login. The changeset calls this out.
• SDK-400 isn't fixed by this alone. Login and configure still call GET /teams here, which mints a new API key for every project server-side; the CLI just stops storing it. feat(cli): pick projects from workspace-api, route to each project's plane #2104, next in the stack, replaces that call with workspace-api /v1/me (BKND-155's CLI side; with access tokens its planned POST /api-keys step is not needed).
• Known limit. Template.build is a single SDK call that polls build status with the credentials it started with. A build running over an hour would need a fresh token mid-call. Handling that needs a header provider in the SDK; I left it out here.

Testing

• New tests/auth.test.ts (10 tests):
  • E2B_API_KEY precedence;
  • bearer headers and project selection (--project > E2B_PROJECT_ID > config);
  • the signed-out exit;
  • refresh storing the rotated tokens and keeping fields it doesn't know;
  • 5 concurrent callers → exactly one refresh;
  • invalid_grant → signed out;
  • stale-lock recovery;
  • tests/utils/lock.test.ts: one holder at a time, release when the holder throws, stale-lock takeover, timeout while a live holder keeps the lock;
  • the /auth/cli URL with and without E2B_DOMAIN.
    With the lock stubbed out, the concurrency and stale-lock tests fail.
• user_config_permissions: unknown fields survive the write, and no temp file is left behind. Migration tests are updated. The command tests mock ensureAuth.
• pnpm run test in packages/cli: 186 passed, 11 skipped (the template create backend suite needs E2B_API_KEY).
• Against prod with my login and no E2B_API_KEY: auth info, sandbox list, template list, then sandbox create --detach → info → exec → logs → kill. All pass.
• Real rotation: I planted an expired access token in my config (keeping the real refresh token) and ran three commands in parallel. All three succeeded, the refresh happened once, the session stayed valid, and the lock file was removed.
• Repo-wide lint and typecheck pass.

Part of PRD-119. Related: SDK-400, BKND-155.

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: da82a36

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@e2b/cli	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

PR Summary

High Risk
Replaces CLI-wide API authentication with OAuth bearer tokens, cross-process refresh locking, and config schema changes; regressions would sign users out or break CI and long-running commands.

Overview
The CLI now resolves credentials via ensureAuth and apiClient, using E2B_API_KEY when set otherwise a Bearer access token with X-Team-ID, refreshed under a proper-lockfile lock with atomic config writes. Login targets CLI_AUTH_URL (/auth/cli); projectApiKey is no longer stored or required in user config. Sandbox, template, and auth commands call ensureAuth per request so follow mode and attached create sessions survive token expiry.

^{Reviewed by Cursor Bugbot for commit da82a36. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Package Artifacts

Built from e8c2f78. Download artifacts from this workflow run.

JS SDK (e2b@2.63.1-mishushakov-cli-access-token-auth.0, with @e2b/dockerfile-utils@0.1.2-mishushakov-cli-access-token-auth.0):

npm install ./e2b-dockerfile-utils-0.1.2-mishushakov-cli-access-token-auth.0.tgz ./e2b-2.63.1-mishushakov-cli-access-token-auth.0.tgz

CLI (@e2b/cli@2.23.1-mishushakov-cli-access-token-auth.0):

npm install ./e2b-cli-2.23.1-mishushakov-cli-access-token-auth.0.tgz

Code Interpreter JS SDK (@e2b/code-interpreter@2.9.2-mishushakov-cli-access-token-auth.0):

npm install ./e2b-code-interpreter-2.9.2-mishushakov-cli-access-token-auth.0.tgz

Desktop JS SDK (@e2b/desktop@2.5.1-mishushakov-cli-access-token-auth.0):

npm install ./e2b-desktop-2.5.1-mishushakov-cli-access-token-auth.0.tgz

Python SDK (e2b==2.63.0+mishushakov.cli.access.token.auth, with e2b-dockerfile-utils==0.1.1+mishushakov.cli.access.token.auth):

pip install ./e2b_dockerfile_utils-0.1.1+mishushakov.cli.access.token.auth-py3-none-any.whl ./e2b-2.63.0+mishushakov.cli.access.token.auth-py3-none-any.whl

Code Interpreter Python SDK (e2b-code-interpreter==2.11.9+mishushakov.cli.access.token.auth):

pip install ./e2b_code_interpreter-2.11.9+mishushakov.cli.access.token.auth-py3-none-any.whl

Desktop Python SDK (e2b-desktop==2.7.2+mishushakov.cli.access.token.auth):

pip install ./e2b_desktop-2.7.2+mishushakov.cli.access.token.auth-py3-none-any.whl

[linear-code]

PRD-119

SDK-437

SDK-400

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T14:45:39.694491Z	53bea5c	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Findings marked 🟡 are optional suggestions and need no follow-up push.

[devin-ai-integration]

Devin Review found 2 new potential issues.

1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)