docs(faq): document why new scopes need a redeploy and a fresh token - #710
Open
amrit-agarwal-1 wants to merge 1 commit into
Open
docs(faq): document why new scopes need a redeploy and a fresh token#710amrit-agarwal-1 wants to merge 1 commit into
amrit-agarwal-1 wants to merge 1 commit into
Conversation
Contributor
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
vnaren23
reviewed
Sep 3, 2026
amrit-agarwal-1
force-pushed
the
docs/faq-scope-changes
branch
2 times, most recently
from
September 3, 2026 07:55
568bd6d to
ef666d3
Compare
Contributor
|
✅ No issues found. Checked for bugs and CLAUDE.md compliance. |
Raina451
reviewed
Sep 3, 2026
amrit-agarwal-1
force-pushed
the
docs/faq-scope-changes
branch
from
September 3, 2026 08:35
ef666d3 to
d939f26
Compare
Contributor
|
✅ No issues found. Checked for bugs and CLAUDE.md compliance. |
Raina451
approved these changes
Sep 3, 2026
vnaren23
approved these changes
Sep 4, 2026
amrit-agarwal-1
force-pushed
the
docs/faq-scope-changes
branch
from
September 8, 2026 05:52
d939f26 to
ac58a88
Compare
Contributor
|
✅ No issues found. Checked for bugs and CLAUDE.md compliance. |
Granting a scope to the External Application is not enough on its own, and what else is needed depends on how the app declares its scopes. If uipath.json has no scope field, deploy pulls every scope granted to the client, so a redeploy is enough. If scope is set in uipath.json, or passed to UiPath() in code, that value wins and the app has to be changed, rebuilt, packed, published and deployed. On top of that the token is cached in sessionStorage and only checked for format and expiry, never for whether its scopes still match, so an open session keeps using the old token until the user signs out or closes the tab. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
amrit-agarwal-1
force-pushed
the
docs/faq-scope-changes
branch
from
September 8, 2026 20:47
ac58a88 to
814b502
Compare
Contributor
|
✅ No issues found. Checked for bugs and CLAUDE.md compliance. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an FAQ entry for something that keeps catching people out: you grant a scope to the External Application, but calls still fail because the token has the old scopes.
Two reasons it doesn't just work:
uipath:scopemeta tag, which is written at deploy time. Editinguipath.jsondoes nothing until you redeploy.sessionStorageand only checked for expiry, not for whether its scopes still match. So an open session keeps the old token.The entry lists the four steps (grant,
uipath.json, redeploy, fresh token) and showssdk.logout().It also says a page refresh won't help. I checked this in a browser,
sessionStoragesurvives a reload. Hard reload only skips the HTTP cache so it won't clear it either, though I couldn't test that one directly.Docs only.
Side note: the scope isn't part of the cache key, so the SDK can't tell the token is stale. Adding it to the key would fix this properly and we could drop the FAQ entry. Can raise separately if you want.