Charles BochetandGitHub
c26c0b9d71
## Summary - **SDK (`dev` & `dev --once`)**: After app registration, the CLI now obtains an `APPLICATION_ACCESS` token via `client_credentials` grant using the app's own `clientId`/`clientSecret`, and uses that token for CoreApiClient schema introspection — instead of the user's `config.accessToken` which returns the full unscoped schema. - **Config**: `oauthClientSecret` is now persisted alongside `oauthClientId` in `~/.twenty/config.json` when creating a new app registration, so subsequent `dev`/`dev --once` runs can obtain fresh app tokens without re-registration. - **CI action**: `spawn-twenty-app-dev-test` now outputs a proper `API_KEY` JWT (signed with the seeded dev workspace secret) instead of the previous hardcoded `ACCESS` token — giving consumers a real API key rather than a user session token. ## Motivation When developing Twenty apps, `yarn twenty dev` was using the CLI user's OAuth token for GraphQL schema introspection during CoreApiClient generation. This token (type `ACCESS`) has no `applicationId` claim, so the server returns the **full workspace schema** — including all objects — rather than the scoped schema the app should see at runtime (filtered by `applicationId`). This caused a discrepancy: the generated CoreApiClient contained fields the app couldn't actually query at runtime with its `APPLICATION_ACCESS` token. By switching to `client_credentials` grant, the SDK now introspects with the same token type the app will use in production, ensuring the generated client accurately reflects the app's runtime capabilities.
This is a Twenty application project bootstrapped with create-twenty-app.
Getting Started
First, authenticate to your workspace:
yarn twenty remote add --api-url http://localhost:2020 --as local
Then, start development mode to sync your app and watch for changes:
yarn twenty dev
Open your Twenty instance and go to /settings/applications section to see the result.
Available Commands
Run yarn twenty help to list all available commands. Common commands:
# Remotes & Authentication
yarn twenty remote add --api-url http://localhost:2020 --as local # Authenticate with Twenty
yarn twenty remote status # Check auth status
yarn twenty remote switch # Switch default remote
yarn twenty remote list # List all configured remotes
yarn twenty remote remove <name> # Remove a remote
# Application
yarn twenty dev # Start dev mode (watch, build, sync, and auto-generate typed client)
yarn twenty add # Add a new entity (object, field, function, front-component, role, view, navigation-menu-item)
yarn twenty logs # Stream function logs
yarn twenty exec # Execute a function with JSON payload
yarn twenty uninstall # Uninstall app from workspace
Integration Tests
If your project includes the example integration test (src/__tests__/app-install.integration-test.ts), you can run it with:
# Make sure a Twenty server is running at http://localhost:3000
yarn test
The test builds and installs the app, then verifies it appears in the applications list. Test configuration (API URL and API key) is defined in vitest.config.ts.
LLMs instructions
Main docs and pitfalls are available in LLMS.md file.
Learn More
To learn more about Twenty applications, take a look at the following resources:
- twenty-sdk - learn about
twenty-sdktool. - Twenty doc - Twenty's documentation.
- Join our Discord
You can check out the Twenty GitHub repository - your feedback and contributions are welcome!