feat(cli): log in to LangSmith without an API key

Reuse the `langsmith login` OAuth profile (~/.langsmith/config.json) for the
deploy commands, refreshing the 5-minute access token per request, and add
`langgraph login` (device flow). With no credentials, an interactive deploy
starts the login flow instead of prompting for an API key.

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>

libs/cli/langgraph_cli/cli.py

@@ -11,6 +11,7 @@ import click.exceptions
 
 import langgraph_cli.config
 import langgraph_cli.docker
+from langgraph_cli import langsmith_auth
 from langgraph_cli.analytics import log_command
 from langgraph_cli.config import Config
 from langgraph_cli.constants import DEFAULT_CONFIG, DEFAULT_PORT
@@ -233,6 +234,13 @@ def cli():
     pass
 
 
+@cli.command(help="Log in to LangSmith in the browser (no API key needed).")
+@click.option("--no-browser", is_flag=True, help="Print the URL instead of opening it.")
+def login(no_browser: bool) -> None:
+    api_url = langsmith_auth.resolve_api_url(os.environ.get("LANGSMITH_ENDPOINT"))
+    langsmith_auth.login(api_url, open_browser=not no_browser)
+
+
 # Wire the deploy group (defined in deploy.py) into the top-level CLI.
 cli.add_command(deploy)
 

libs/cli/langgraph_cli/deploy.py

@@ -1,6 +1,7 @@
 """Deploy command and subcommands for the LangGraph CLI."""
 
 import base64
+import functools
 import json as json_mod
 import os
 import pathlib
@@ -19,6 +20,7 @@ import click.exceptions
 from dotenv import dotenv_values, set_key
 
 import langgraph_cli.config
+from langgraph_cli import langsmith_auth
 from langgraph_cli.analytics import log_command
 from langgraph_cli.config import Config
 from langgraph_cli.constants import DEFAULT_CONFIG
@@ -1982,17 +1984,6 @@ def _create_host_backend_client(
             if val:
                 resolved_api_key = val
                 break
-    if not resolved_api_key:
-        if effective_no_input:
-            raise click.ClickException(
-                "No LangSmith API key found. Set LANGSMITH_API_KEY in the "
-                "environment or .env file."
-            )
-        click.secho(
-            "No LangSmith API key found. Create one at Settings > API Keys in LangSmith.",
-            fg="yellow",
-        )
-        resolved_api_key = click.prompt("Enter LangSmith API key", hide_input=True)
     tenant_id = env_vars.get("LANGSMITH_TENANT_ID") or os.environ.get(
         "LANGSMITH_TENANT_ID"
     )
@@ -2000,8 +1991,31 @@ def _create_host_backend_client(
         "LANGSMITH_ENDPOINT"
     )
     endpoints = ControlPlaneEndpoints.resolve(host_url, langsmith_endpoint)
+
+    access_token: Callable[[], str] | None = None
+    if not resolved_api_key:
+        profile = langsmith_auth.load_profile()
+        api_url = langsmith_auth.resolve_api_url(langsmith_endpoint)
+        if profile.get("api_key"):
+            resolved_api_key = profile["api_key"]
+        else:
+            if not any((profile.get("oauth") or {}).values()):
+                if effective_no_input:
+                    raise click.ClickException(
+                        "No LangSmith credentials found. Set LANGSMITH_API_KEY "
+                        "in the environment or .env file (an API key), or run "
+                        "`langgraph login`."
+                    )
+                click.secho("You are not logged in to LangSmith.", fg="yellow")
+                langsmith_auth.login(api_url)
+                profile = langsmith_auth.load_profile()
+            access_token = functools.partial(langsmith_auth.get_access_token, api_url)
+        tenant_id = tenant_id or profile.get("workspace_id")
     return HostBackendClient(
-        endpoints.control_plane_url, resolved_api_key, tenant_id=tenant_id
+        endpoints.control_plane_url,
+        resolved_api_key,
+        tenant_id=tenant_id,
+        **({"access_token": access_token} if access_token else {}),
     )
 
 

libs/cli/langgraph_cli/host_backend.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from collections.abc import Mapping
+from collections.abc import Callable, Mapping
 from dataclasses import dataclass
 from typing import Any, Literal
 from urllib.parse import urlparse
@@ -130,17 +130,18 @@ class HostBackendClient:
     def __init__(
         self,
         base_url: str,
-        api_key: str,
+        api_key: str | None,
         tenant_id: str | None = None,
         *,
+        access_token: Callable[[], str] | None = None,
         transport: httpx.BaseTransport | None = None,
     ):
         if not base_url:
             raise click.UsageError("Host backend URL is required")
-        headers: dict[str, str] = {
-            "X-Api-Key": api_key,
-            "Accept": "application/json",
-        }
+        self._access_token = access_token
+        headers: dict[str, str] = {"Accept": "application/json"}
+        if api_key:
+            headers["X-Api-Key"] = api_key
         if tenant_id:
             headers["X-Tenant-ID"] = tenant_id
         self._endpoints = ControlPlaneEndpoints.from_control_plane_url(base_url)
@@ -170,8 +171,15 @@ class HostBackendClient:
         payload: dict[str, Any] | None = None,
         params: dict[str, Any] | None = None,
     ) -> Any:
+        headers = (
+            {"Authorization": f"Bearer {self._access_token()}"}
+            if self._access_token
+            else None
+        )
         try:
-            resp = self._client.request(method, path, json=payload, params=params)
+            resp = self._client.request(
+                method, path, json=payload, params=params, headers=headers
+            )
             resp.raise_for_status()
         except httpx.HTTPStatusError as err:
             detail = _error_detail(err.response)

libs/cli/langgraph_cli/langsmith_auth.py

@@ -0,0 +1,225 @@
+"""LangSmith OAuth login, shared with the ``langsmith`` CLI via ``~/.langsmith/config.json``."""
+
+from __future__ import annotations
+
+import datetime
+import json
+import os
+import pathlib
+import time
+import webbrowser
+from typing import Any
+from urllib.parse import urlparse
+
+import click
+import httpx
+
+CLIENT_ID = "langsmith-cli"
+DEFAULT_API_URL = "https://api.smith.langchain.com"
+_WELL_KNOWN = "/.well-known/oauth-authorization-server"
+_REFRESH_LEEWAY = datetime.timedelta(seconds=60)
+_DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code"
+
+
+def _config_path() -> pathlib.Path:
+    override = os.environ.get("LANGSMITH_CONFIG_FILE")
+    if override:
+        return pathlib.Path(override)
+    return pathlib.Path.home() / ".langsmith" / "config.json"
+
+
+def _read_config() -> dict[str, Any]:
+    try:
+        config = json.loads(_config_path().read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return {}
+    return config if isinstance(config, dict) else {}
+
+
+def _write_config(config: dict[str, Any]) -> None:
+    path = _config_path()
+    path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+    tmp = path.with_name(path.name + ".tmp")
+    tmp.write_text(json.dumps(config, indent=2) + "\n", encoding="utf-8")
+    os.chmod(tmp, 0o600)
+    os.replace(tmp, path)
+
+
+def _profile_name(config: dict[str, Any]) -> str:
+    return (
+        os.environ.get("LANGSMITH_PROFILE")
+        or config.get("current_profile")
+        or "default"
+    )
+
+
+def load_profile() -> dict[str, Any]:
+    """Return the active profile from the LangSmith config file, or ``{}``."""
+    config = _read_config()
+    profile = (config.get("profiles") or {}).get(_profile_name(config))
+    return profile if isinstance(profile, dict) else {}
+
+
+def resolve_api_url(endpoint: str | None = None) -> str:
+    """Pick the LangSmith API URL: explicit endpoint, then profile, then cloud."""
+    return endpoint or load_profile().get("api_url") or DEFAULT_API_URL
+
+
+def _save_tokens(token: dict[str, Any], api_url: str | None = None) -> None:
+    config = _read_config()
+    name = _profile_name(config)
+    profile = config.setdefault("profiles", {}).setdefault(name, {})
+    if api_url:
+        profile["api_url"] = api_url
+    oauth = profile.setdefault("oauth", {})
+    oauth["access_token"] = token["access_token"]
+    if token.get("refresh_token"):
+        oauth["refresh_token"] = token["refresh_token"]
+    if token.get("expires_in"):
+        expires_at = datetime.datetime.now(datetime.timezone.utc) + (
+            datetime.timedelta(seconds=int(token["expires_in"]))
+        )
+        oauth["expires_at"] = expires_at.strftime("%Y-%m-%dT%H:%M:%SZ")
+    config.setdefault("current_profile", name)
+    _write_config(config)
+
+
+def _oauth_endpoints(api_url: str) -> dict[str, str]:
+    """Discover the OAuth endpoints, falling back to ``<root>/oauth/*``."""
+    root = api_url.rstrip("/")
+    for suffix in ("/api/v1", "/api"):
+        if root.endswith(suffix):
+            root = root[: -len(suffix)]
+            break
+    for base in (root, f"{root}/api"):
+        try:
+            resp = httpx.get(base + _WELL_KNOWN, timeout=10)
+            doc = resp.json() if resp.is_success else None
+        except (httpx.HTTPError, ValueError):
+            continue
+        if (
+            isinstance(doc, dict)
+            and str(doc.get("issuer", "")).rstrip("/") == base
+            and all(
+                urlparse(str(doc.get(key, ""))).netloc == urlparse(base).netloc
+                for key in ("token_endpoint", "device_authorization_endpoint")
+            )
+        ):
+            return {
+                "issuer": base,
+                "token": doc["token_endpoint"],
+                "device": doc["device_authorization_endpoint"],
+            }
+    return {
+        "issuer": root,
+        "token": f"{root}/oauth/token",
+        "device": f"{root}/oauth/device/code",
+    }
+
+
+def _expiring(oauth: dict[str, Any]) -> bool:
+    if not oauth.get("access_token"):
+        return True
+    expires_at = oauth.get("expires_at")
+    if not expires_at:
+        return False
+    try:
+        expiry = datetime.datetime.fromisoformat(expires_at.replace("Z", "+00:00"))
+    except ValueError:
+        return True
+    if expiry.tzinfo is None:
+        expiry = expiry.replace(tzinfo=datetime.timezone.utc)
+    return expiry <= datetime.datetime.now(datetime.timezone.utc) + _REFRESH_LEEWAY
+
+
+def get_access_token(api_url: str) -> str:
+    """Return a valid access token from the profile, refreshing it if needed."""
+    oauth = load_profile().get("oauth") or {}
+    if not _expiring(oauth):
+        return oauth["access_token"]
+    refresh_token = oauth.get("refresh_token")
+    if not refresh_token:
+        raise click.ClickException(
+            "LangSmith session expired. Run `langgraph login` to sign in again."
+        )
+    endpoints = _oauth_endpoints(api_url)
+    try:
+        resp = httpx.post(
+            endpoints["token"],
+            data={
+                "grant_type": "refresh_token",
+                "client_id": CLIENT_ID,
+                "refresh_token": refresh_token,
+            },
+            timeout=10,
+        )
+        resp.raise_for_status()
+        token = resp.json()
+    except (httpx.HTTPError, ValueError):
+        raise click.ClickException(
+            "Could not refresh your LangSmith session. "
+            "Run `langgraph login` to sign in again."
+        ) from None
+    if not isinstance(token, dict) or not token.get("access_token"):
+        raise click.ClickException(
+            "Could not refresh your LangSmith session. "
+            "Run `langgraph login` to sign in again."
+        )
+    _save_tokens(token)
+    return token["access_token"]
+
+
+def login(api_url: str, *, open_browser: bool = True) -> None:
+    """Sign in with the OAuth device flow and store tokens in the profile."""
+    endpoints = _oauth_endpoints(api_url)
+    try:
+        resp = httpx.post(
+            endpoints["device"],
+            data={"client_id": CLIENT_ID, "resource": endpoints["issuer"]},
+            timeout=10,
+        )
+        resp.raise_for_status()
+        device = resp.json()
+        device_code, user_code = device["device_code"], device["user_code"]
+        verification_url = (
+            device.get("verification_uri_complete") or device["verification_uri"]
+        )
+    except (httpx.HTTPError, ValueError, KeyError):
+        raise click.ClickException(
+            f"Could not start LangSmith login against {api_url}."
+        ) from None
+
+    click.echo(f"Open this URL to authorize the CLI:\n{verification_url}\n")
+    click.echo(f"Code: {user_code}\n")
+    if open_browser:
+        webbrowser.open(verification_url)
+    click.echo("Waiting for authorization...")
+
+    interval = max(int(device.get("interval") or 5), 5)
+    deadline = time.monotonic() + int(device.get("expires_in") or 600)
+    while time.monotonic() < deadline:
+        time.sleep(interval)
+        try:
+            resp = httpx.post(
+                endpoints["token"],
+                data={
+                    "grant_type": _DEVICE_GRANT,
+                    "client_id": CLIENT_ID,
+                    "device_code": device_code,
+                    "resource": endpoints["issuer"],
+                },
+                timeout=10,
+            )
+            body = resp.json()
+        except (httpx.HTTPError, ValueError):
+            continue
+        if resp.is_success and body.get("access_token"):
+            _save_tokens(body, api_url)
+            click.secho("Logged in to LangSmith.", fg="green")
+            return
+        error = body.get("error") if isinstance(body, dict) else None
+        if error == "slow_down":
+            interval += 5
+        elif error != "authorization_pending":
+            raise click.ClickException(f"LangSmith login failed: {error or 'error'}.")
+    raise click.ClickException("Timed out waiting for LangSmith login.")

libs/cli/tests/unit_tests/test_deploy_helpers.py

@@ -578,12 +578,13 @@ def test_a_deployed_result_prints_the_deployment_url(
 class TestCreateHostBackendClientNoInput:
     def test_raises_when_no_api_key_and_no_input(self, monkeypatch, tmp_path):
 
+        monkeypatch.setenv("LANGSMITH_CONFIG_FILE", str(tmp_path / "missing.json"))
         monkeypatch.setattr(deploy_mod, "_no_input", True)
         monkeypatch.delenv("LANGSMITH_API_KEY", raising=False)
         monkeypatch.delenv("LANGCHAIN_API_KEY", raising=False)
         monkeypatch.delenv("LANGGRAPH_HOST_API_KEY", raising=False)
 
-        with pytest.raises(click.ClickException, match="API key"):
+        with pytest.raises(click.ClickException, match="credentials"):
             _create_host_backend_client(
                 host_url="https://api.example.com",
                 api_key=None,

libs/cli/tests/unit_tests/test_langsmith_auth.py

@@ -0,0 +1,191 @@
+import json
+from datetime import datetime, timedelta, timezone
+
+import click
+import httpx
+import pytest
+
+from langgraph_cli import deploy as deploy_mod
+from langgraph_cli import langsmith_auth
+from langgraph_cli.deploy import _create_host_backend_client
+from langgraph_cli.host_backend import HostBackendClient
+
+API_URL = "https://api.smith.langchain.com"
+
+
+def _iso(delta: timedelta) -> str:
+    return (datetime.now(timezone.utc) + delta).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+@pytest.fixture
+def config_file(tmp_path, monkeypatch):
+    path = tmp_path / "config.json"
+    monkeypatch.setenv("LANGSMITH_CONFIG_FILE", str(path))
+    monkeypatch.delenv("LANGSMITH_PROFILE", raising=False)
+    for name in ("LANGGRAPH_HOST_API_KEY", "LANGSMITH_API_KEY", "LANGCHAIN_API_KEY"):
+        monkeypatch.delenv(name, raising=False)
+    return path
+
+
+def _write_profile(path, **oauth):
+    path.write_text(
+        json.dumps(
+            {
+                "current_profile": "default",
+                "profiles": {
+                    "default": {
+                        "api_url": API_URL,
+                        "workspace_id": "ws-1",
+                        "oauth": oauth,
+                    }
+                },
+            }
+        )
+    )
+
+
+def _no_discovery(monkeypatch):
+    def get(*_a, **_k):
+        raise httpx.ConnectError("no discovery")
+
+    monkeypatch.setattr(httpx, "get", get)
+
+
+def test_valid_token_is_returned_without_network(config_file, monkeypatch):
+    _write_profile(
+        config_file, access_token="tok", expires_at=_iso(timedelta(minutes=5))
+    )
+
+    def boom(*_a, **_k):
+        raise AssertionError("no network expected")
+
+    monkeypatch.setattr(httpx, "get", boom)
+    monkeypatch.setattr(httpx, "post", boom)
+
+    assert langsmith_auth.get_access_token(API_URL) == "tok"
+
+
+def test_expired_token_is_refreshed_and_saved(config_file, monkeypatch):
+    _write_profile(
+        config_file,
+        access_token="old",
+        refresh_token="refresh-1",
+        expires_at=_iso(timedelta(seconds=-5)),
+    )
+    _no_discovery(monkeypatch)
+    seen = {}
+
+    def post(url, data, timeout):
+        seen.update(url=url, data=data)
+        return httpx.Response(
+            200,
+            json={
+                "access_token": "new",
+                "refresh_token": "refresh-2",
+                "expires_in": 300,
+            },
+            request=httpx.Request("POST", url),
+        )
+
+    monkeypatch.setattr(httpx, "post", post)
+
+    assert langsmith_auth.get_access_token(API_URL) == "new"
+    assert seen["url"] == f"{API_URL}/oauth/token"
+    assert seen["data"]["refresh_token"] == "refresh-1"
+    saved = json.loads(config_file.read_text())["profiles"]["default"]["oauth"]
+    assert saved["access_token"] == "new"
+    assert saved["refresh_token"] == "refresh-2"
+
+
+def test_expired_token_without_refresh_token_asks_to_log_in(config_file):
+    _write_profile(
+        config_file, access_token="old", expires_at=_iso(timedelta(seconds=-5))
+    )
+    with pytest.raises(click.ClickException, match="langgraph login"):
+        langsmith_auth.get_access_token(API_URL)
+
+
+def test_login_stores_tokens_after_pending(config_file, monkeypatch):
+    _no_discovery(monkeypatch)
+    monkeypatch.setattr(langsmith_auth.time, "sleep", lambda _s: None)
+    monkeypatch.setattr(langsmith_auth.webbrowser, "open", lambda _u: True)
+    token_responses = iter(
+        [
+            {"error": "authorization_pending"},
+            {"access_token": "tok", "refresh_token": "r", "expires_in": 300},
+        ]
+    )
+
+    def post(url, data, timeout):
+        request = httpx.Request("POST", url)
+        if url.endswith("/oauth/device/code"):
+            return httpx.Response(
+                200,
+                json={
+                    "device_code": "dc",
+                    "user_code": "ABCD",
+                    "verification_uri": "https://example.com/activate",
+                    "expires_in": 600,
+                    "interval": 5,
+                },
+                request=request,
+            )
+        body = next(token_responses)
+        return httpx.Response(
+            400 if "error" in body else 200, json=body, request=request
+        )
+
+    monkeypatch.setattr(httpx, "post", post)
+
+    langsmith_auth.login(API_URL)
+
+    profile = json.loads(config_file.read_text())["profiles"]["default"]
+    assert profile["api_url"] == API_URL
+    assert profile["oauth"]["access_token"] == "tok"
+
+
+def test_client_sends_bearer_token_per_request():
+    seen = []
+
+    def handler(req: httpx.Request) -> httpx.Response:
+        seen.append(dict(req.headers))
+        return httpx.Response(200, json={"resources": []})
+
+    tokens = iter(["t1", "t2"])
+    client = HostBackendClient(
+        "https://api.example.com",
+        None,
+        access_token=lambda: next(tokens),
+        transport=httpx.MockTransport(handler),
+    )
+    client.list_deployments()
+    client.list_deployments()
+
+    assert [h["authorization"] for h in seen] == ["Bearer t1", "Bearer t2"]
+    assert "x-api-key" not in seen[0]
+
+
+def test_factory_uses_logged_in_profile(config_file, monkeypatch):
+    _write_profile(
+        config_file, access_token="tok", expires_at=_iso(timedelta(minutes=5))
+    )
+    monkeypatch.setattr(deploy_mod, "_no_input", True)
+    monkeypatch.delenv("LANGSMITH_TENANT_ID", raising=False)
+    monkeypatch.delenv("LANGSMITH_ENDPOINT", raising=False)
+
+    client = _create_host_backend_client(
+        host_url="https://api.example.com", api_key=None, env_vars={}
+    )
+
+    assert client._access_token is not None
+    assert client._access_token() == "tok"
+    assert client._client.headers["x-tenant-id"] == "ws-1"
+    assert "x-api-key" not in client._client.headers
+
+
+def test_factory_without_credentials_and_no_input_fails(config_file, monkeypatch):
+    monkeypatch.setattr(deploy_mod, "_no_input", True)
+    with pytest.raises(click.ClickException, match="langgraph login"):
+        _create_host_backend_client(
+            host_url="https://api.example.com", api_key=None, env_vars={}
+        )