From 8486eba6f5db1a5fafa9719f58841793c3161283 Mon Sep 17 00:00:00 2001
From: Jens Langhammer <jens.langhammer@beryju.org>
Date: Thu, 22 Oct 2026 14:08:28 +0100
Subject: [PATCH] ak-cli: fix claude missing assertion and grant_type

---
 ak-cli/src/auth/claude.rs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/ak-cli/src/auth/claude.rs b/ak-cli/src/auth/claude.rs
index 4e74d98b..424151a5 100644
--- a/ak-cli/src/auth/claude.rs
+++ b/ak-cli/src/auth/claude.rs
@@ -21,6 +21,8 @@ pub struct CredentialsOpts {
 
 #[derive(Serialize)]
 struct ClaudeTokenExchange {
+    grant_type: String,
+    assertion: String,
     federation_rule_id: String,
     organization_id: String,
     service_account_id: String,
@@ -91,6 +93,8 @@ pub async fn get_credentials(
     let res: ClaudeTokenResponse = client
         .post("https://api.anthropic.com/v1/oauth/token")
         .json(&ClaudeTokenExchange {
+            grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer".to_string(),
+            assertion: res.access_token,
             federation_rule_id: opts.federation_rule_id,
             organization_id: opts.organization_id,
             service_account_id: opts.service_account_id,
@@ -98,7 +102,6 @@ pub async fn get_credentials(
         })
         .send()
         .await?
-        // curl -sS happily returns error bodies, fail loudly instead
         .error_for_status()?
         .json()
         .await?;