Import personal access tokens with auth login --with-token (#681)

* Import personal access tokens with auth login --with-token

A bot's Basecamp identity should never come from a browser sign-in on a
shared machine: whoever's session the browser holds is who the profile
quietly becomes, and nothing checks. Basecamp now mints personal access
tokens, so the CLI can take one from a secret store and refuse to keep it
unless it authenticates as the expected identity.

`basecamp auth login --with-token -P <profile> --account <id>` reads the
token from stdin (a terminal is refused, with the `op read … |` shape
shown), stores it under the profile as a non-expiring bc5 credential —
ExpiresAt 0 is the path AccessToken already never refreshes — and creates
the profile when --account names its account. The profile entry is written
only after /my/profile.json and the authorization endpoint have answered
for the token; a rejected token leaves the profile exactly as it was found,
previous credential included. Profile registration is factored out of
`profile create` so both paths write the same entry, and the root pre-run
lets a may-create command name a profile that does not exist yet.

`--expect-identity <id>` makes every login assertive — browser and device
flows included — discarding the new credential on a mismatch. `--json`
returns the envelope (profile, account, identity, person, oauth_type,
scope, expires_at null), and the interactive flows now refuse machine
output modes up front instead of printing prose and blocking (the
machine-mode half of #669).

`BASECAMP_OAUTH_ISSUER` pins the BC5 authorization server and skips
discovery, so a device login reaches a server that is piloting the client
while its metadata is still dark. It is a temporary escape hatch and is
documented as one. `--login-hint <email>` is wired through LoginOptions;
the pinned SDK cannot put it on the wire yet (basecamp/basecamp-sdk#841
adds the option), so this build tells the user the hint instead of sending
it, and Launchpad ignores it.

* Verify a login before storing it

Review of the token import found the rollback doing the wrong job: the
credential was written under the live profile key, checked, and then
restored or deleted — a window where another command could pick up an
unverified token, a restore that could itself fail, and a success line
printed before the check. Turn it around: the candidate token gets a client
of its own (App.SDKClientFor, same transport, hooks and user agent as the
real one), proves itself, and only then is stored. LoginOptions.Verify runs
that check inside the device and Launchpad flows before their store.Save,
so --expect-identity on a browser login stores nothing on a mismatch; the
snapshot/restore code is gone.

The check now covers the account, not only the identity. Production
serves /my/profile.json only under an account prefix (the unscoped path
404s — the old "Logged in as" line had been failing silently), so the
person lookup goes through the account-scoped People().Me, and that
account must be numeric, must be the effective one (--account or
BASECAMP_ACCOUNT_ID override the profile binding at runtime, so the
mismatch guard compares against that), must appear non-expired in the
authorization document, and for a new profile must have been given
explicitly rather than inherited from the operator's config. A reported
scope outside read/full is refused rather than stored.

Smaller findings from the same round: --scope and --expect-identity are
validated before stdin is consumed; --expect-identity compares parsed
integers; the envelope reports the identity's own email and marks an
existing default profile as default; server-supplied names, the login
hint and the pinned issuer are reduced to one line before reaching the
terminal; an unregistered profile name is no longer used as a cache path
component; the e2e cases assert exact error and code with BASECAMP_PROFILE
cleared; README and the doctor skill describe the token import, the
identity assertion, and that --login-hint is announced, not sent.

* Bind what the token was verified for, and keep ordinary logins best-effort

The import verifies a token for one account and base URL and stores it
under a profile; those must be the same place. An existing profile's base
URL must match the effective one (a BASECAMP_BASE_URL override would
verify against one host and store for another), an unbound profile is
bound to the explicitly given account alongside the token (other fields
preserved), and account comparisons are numeric like the rest of the
package. The profile entry is written before the credential, so a failure
between the two leaves a visibly unauthenticated profile rather than an
orphaned secret. Strict verification refuses an authorization document
with no identity id.

An ordinary browser or device login without --expect-identity is not the
assertive kind: an account the token cannot reach, or a person lookup
that fails, no longer discards the login — the identity line falls back
to the authorization document and no person id is fabricated (nothing is
written as user_id 0 either).

Stdin accepts exactly one trailing line ending, the shape a pipe delivers,
rather than trimming whatever whitespace surrounds the secret.

* Keep the server's expiry, refuse stray arguments and non-global bindings

The authorization document reports when the token expires; the import
now stores that instead of claiming the token never does, and the
envelope and status line report it. With no refresh token, AccessToken
refuses the token near expiry with the existing "No refresh token"
error, so the remedy — import again — is named rather than discovered
from failing requests. A document without an expiry still stores zero.

The login command takes no positional arguments, so a token pasted after
--with-token is refused instead of being ignored while it sits in shell
history. Binding an accountless profile rewrites the global config file,
so a profile that arrived from a system, repo or local config is refused
before stdin is read rather than left shadowing a binding it never sees.

* Judge a profile binding by the global file's own entry, refuse near-expiry tokens

Config layers merge profiles per name and record one aggregate source for
the whole map, so cfg.Sources["profiles"] cannot say where a particular
profile came from — a global unbound profile was refused whenever a repo
or local config contributed any other profile. Read the global file's
entry instead: binding proceeds when that entry exists and is unbound,
and is refused (before stdin) when it is missing or already bound, since
the accountless effective profile then came from another layer and would
keep shadowing whatever is written.

An imported token has nothing to refresh with, so one that the server
reports as expiring inside the refresh window would be refused by its
first command; the import now declines it up front. RefreshWindow is
exported from the auth package for that check instead of repeating the
five-minute literal.

* Refuse to rewrite a malformed config, and limit the expiry refusal to imports

Every writer of the global config file read it with parse errors ignored
and then wrote the map back, so a token import that registered a profile
could replace an operator's malformed-but-present config with a partial
decode. loadGlobalConfigFile now treats only a missing file as empty and
returns read and parse errors; register, unregister, bind and set-default
all go through it and refuse before writing.

The near-expiry refusal exists because an imported token has nothing to
refresh with. An asserted OAuth login (--expect-identity) reaches the same
verifier with a refresh token in hand, so the check is keyed to the
import (noRefresh) rather than to strict mode.

Imported credentials record source: "token", and auth status and profile
show report it, so a machine consumer can tell a non-refreshable personal
token from an OAuth credential.

* Pin an origin only, refuse a non-object profiles value, and name app.basecamp.com

BASECAMP_OAUTH_ISSUER derives its endpoints by appending /oauth/... to
the value, so a path would produce endpoints nothing serves; only an
origin is accepted now (no path, no opaque form). The global config
writers refuse a "profiles" value that is not an object for the same
reason they refuse a parse failure, and loadGlobalConfigFile creates the
config directory so every writer — set-default included — can run before
a global config exists. The README names app.basecamp.com for the token
page and the pinned issuer.

* Prove the config can take a profile before profile create logs in

profile create registers its entry after the OAuth login, and the global
config writers now refuse a malformed file, so a refusal there would have
left a live credential with no profile. The file is checked for
writability before the login runs; nothing is written by the check. The
README no longer calls an imported token non-expiring — its expiry is
whatever the server reports.

* Bump basecamp-sdk to main and send --login-hint on the wire

basecamp-sdk#841 (47e7ca38) adds oauth.WithDeviceLoginHint, so the device
flow now carries --login-hint as Basecamp's login_hint extension to the
device authorization request instead of telling the user the hint. The
option is appended only when a hint was given, so an unqualified login's
form is unchanged. Launchpad still logs that it ignores the flag.

make bump-sdk REF=main: v0.15.0 → v0.16.1-0.20260903193203-47e7ca381a49,
provenance updated; the catalog parity tests pass against the new SDK.

* Record the pinned SDK revision in the MCP model provenance

main now checks that the vendored MCP model was synced from the same
basecamp-sdk revision go.mod pins. This branch pins the post-v0.16.0
commit that carries the device-flow login hint, so the provenance moves
to that commit. scripts/sync-mcp-model.sh against that checkout leaves
behavior-model.json and openapi.json byte-identical to the v0.16.0
snapshot, and would describe the ref as go/v0.16.0-1-g47e7ca38; the ref
is written as the go.mod pseudo-version instead, which is what the
provenance test compares. A v0.16.1 tag would restore the tagged shape.

* Strip a trailing CR only as part of a CRLF pair

A token ending in a bare carriage return was accepted: the LF and CR
suffixes were trimmed independently, so "token\r" lost its CR and passed
the control-character check the contract says it must fail. The CR now
goes only when it precedes the final LF; on its own it is left for the
single-line check to refuse.

* Refuse a null config, and prove the file is writable before anything irreversible

The global config writers refuse a malformed file rather than rewrite
it, but a top-level null decoded into a nil map and the next assignment
panicked instead. It is refused like any other non-object value.

Two callers ran the refusal after a step that cannot be taken back: the
token import read stdin and verified the token against the server before
registering or binding the profile discovered the file was unusable, and
profile delete removed the credential first. Both now prove the file can
take the write up front, as profile create already did.

* Refuse a login whose override disagrees with the profile's binding, OAuth included

The token import refused an --account / BASECAMP_ACCOUNT_ID /
BASECAMP_BASE_URL override that disagreed with the named profile's
binding, since the credential would be verified for the override and
stored under a key that keeps the binding. The browser and device flows
had no such check: an asserted login under an override verified against
the override and then replaced the profile's working credential with one
proven for somewhere else. The check is one helper now, run by every
login that names an existing profile before any request is made.

* Let profile create assert the identity it signs in as

--expect-identity ran only on auth login, which refuses a profile that
does not exist yet; the browser or device login that creates one had no
way to refuse a wrong session. profile create takes the same flag and
runs the same verifier before the credential is stored: a mismatch
leaves no credential and no profile entry.

The verifier's account-scoped person lookup replaces the unscoped
/my/profile.json fetch that ran after registration, which production
answers with a 404. SDKClientFor now addresses the effective base URL
rather than the one the startup client was built with, since a profile
being created sets its own in memory before its login runs; for every
existing caller the two are the same value.

* Return only the error from writableGlobalProfiles, since no caller reads the map

* Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445

An indirect dependency main carries too; the Security workflow's Trivy
scan started failing on it once the advisory reached the database.

* Reject a bare query or fragment delimiter on the pinned issuer

url.Parse reports "https://as.example#" with an empty fragment, so the
origin check passed it, and the endpoints derived by concatenation
carried the delimiter: the token endpoint became https://as.example#/oauth/tokens,
posting to / with the path as a fragment. The delimiters are now refused
on the raw value.

* Say an imported token reported no expiry, not that it never expires

* Name the config preflight for what it checks

globalConfigTakesProfiles reads and validates the file's shape; it does
not probe permissions, and the old name claimed more than that.

* Recompute the Nix vendorHash for the SDK pin and grpc bump

Computed and verified with make update-nix-hash (Docker build succeeds
with the new hash).

Author: jeremy

.surface

@@ -1945,13 +1945,15 @@ FLAG basecamp auth login --agent type=bool
 FLAG basecamp auth login --cache-dir type=string
 FLAG basecamp auth login --count type=bool
 FLAG basecamp auth login --device-code type=bool
+FLAG basecamp auth login --expect-identity type=string
 FLAG basecamp auth login --help type=bool
 FLAG basecamp auth login --hints type=bool
 FLAG basecamp auth login --ids-only type=bool
 FLAG basecamp auth login --in type=string
 FLAG basecamp auth login --jq type=string
 FLAG basecamp auth login --json type=bool
 FLAG basecamp auth login --local type=bool
+FLAG basecamp auth login --login-hint type=string
 FLAG basecamp auth login --markdown type=bool
 FLAG basecamp auth login --md type=bool
 FLAG basecamp auth login --no-browser type=bool
@@ -1966,6 +1968,7 @@ FLAG basecamp auth login --stats type=bool
 FLAG basecamp auth login --styled type=bool
 FLAG basecamp auth login --todolist type=string
 FLAG basecamp auth login --verbose type=count
+FLAG basecamp auth login --with-token type=bool
 FLAG basecamp auth logout --account type=string
 FLAG basecamp auth logout --agent type=bool
 FLAG basecamp auth logout --cache-dir type=string
@@ -10740,13 +10743,15 @@ FLAG basecamp login --agent type=bool
 FLAG basecamp login --cache-dir type=string
 FLAG basecamp login --count type=bool
 FLAG basecamp login --device-code type=bool
+FLAG basecamp login --expect-identity type=string
 FLAG basecamp login --help type=bool
 FLAG basecamp login --hints type=bool
 FLAG basecamp login --ids-only type=bool
 FLAG basecamp login --in type=string
 FLAG basecamp login --jq type=string
 FLAG basecamp login --json type=bool
 FLAG basecamp login --local type=bool
+FLAG basecamp login --login-hint type=string
 FLAG basecamp login --markdown type=bool
 FLAG basecamp login --md type=bool
 FLAG basecamp login --no-browser type=bool
@@ -10761,6 +10766,7 @@ FLAG basecamp login --stats type=bool
 FLAG basecamp login --styled type=bool
 FLAG basecamp login --todolist type=string
 FLAG basecamp login --verbose type=count
+FLAG basecamp login --with-token type=bool
 FLAG basecamp logout --account type=string
 FLAG basecamp logout --agent type=bool
 FLAG basecamp logout --cache-dir type=string
@@ -11927,6 +11933,7 @@ FLAG basecamp profile create --base-url type=string
 FLAG basecamp profile create --cache-dir type=string
 FLAG basecamp profile create --count type=bool
 FLAG basecamp profile create --device-code type=bool
+FLAG basecamp profile create --expect-identity type=string
 FLAG basecamp profile create --help type=bool
 FLAG basecamp profile create --hints type=bool
 FLAG basecamp profile create --ids-only type=bool

README.md

@@ -194,6 +194,34 @@ basecamp auth login --scope full # Full read+write access (default; ignored by L
 basecamp auth token              # Print token for scripts
 ```
 
+`--expect-identity <id>` makes any login assert who it authenticated as: the
+new credential is checked before it is stored, and on a mismatch nothing is
+written (a profile's previous credential is untouched) and the command exits
+non-zero. `basecamp profile create <name> --expect-identity <id>` does the same
+for a profile that does not exist yet. `--login-hint <email>` names the account to sign in as on the
+device-flow approval page (sent as `login_hint`; it steers the sign-in page and
+never authenticates on its own; ignored by Launchpad).
+
+### Personal access tokens
+
+A [personal access token](https://app.basecamp.com/my/access_tokens) can be
+imported instead of running OAuth — the shape for bots, CI, and any machine
+that should never sign in interactively. The token is read from stdin (never
+an argument), verified against the server — who it authenticates as, and that
+it can reach the profile's account — and only then stored under a named
+profile, with whatever expiry the server reports for it:
+
+```bash
+op read "op://Vault/Item/credential" | basecamp auth login --with-token -P bot --account 999
+op read "op://Vault/Item/credential" | basecamp auth login --with-token -P bot --account 999 --expect-identity 12345 --json
+```
+
+`--account` is required when the profile does not exist yet. `--json` returns
+an envelope with the profile, account, identity and person, `oauth_type`,
+`scope`, and `expires_at` (the expiry the server reports for the token, or
+`null` when it reports none). A token has no refresh token, so near a reported
+expiry the CLI refuses it and asks for a fresh import.
+
 ### Multiple Identities
 
 Use named profiles when the same machine or agent gateway needs more than one Basecamp identity. Each profile has its own stored OAuth credentials and can be selected per command:
@@ -218,6 +246,12 @@ To use your own OAuth app (e.g., a custom Launchpad integration):
 
 Both `BASECAMP_OAUTH_CLIENT_ID` and `BASECAMP_OAUTH_CLIENT_SECRET` must be set together.
 
+`BASECAMP_OAUTH_ISSUER=https://app.basecamp.com` pins the OAuth authorization
+server and skips discovery, so `basecamp auth login` reaches a server that is
+serving piloted clients but not yet advertising itself (discovery still 404s).
+It is a temporary escape hatch for that dark pilot, not a configuration
+surface, and will be removed once the server advertises its metadata.
+
 ## AI Agent Integration
 
 `basecamp` works with any AI agent that can run shell commands.

e2e/auth.bats

@@ -90,6 +90,35 @@ load test_helper
   assert_output_contains "default full"
 }
 
+@test "basecamp auth login --help shows --with-token, --expect-identity, and --login-hint" {
+  run basecamp auth login --help
+  assert_success
+  assert_output_contains "--with-token"
+  assert_output_contains "--expect-identity"
+  assert_output_contains "--login-hint"
+  assert_output_contains "op read"
+}
+
+@test "basecamp auth login --with-token requires a profile" {
+  run env -u BASECAMP_PROFILE basecamp auth login --with-token </dev/null
+  assert_failure
+  assert_json_value '.error' '--with-token stores the token under a named profile'
+  assert_json_value '.code' 'usage'
+}
+
+@test "basecamp auth login --with-token needs --account to create the profile" {
+  run basecamp auth login --with-token -P bot </dev/null
+  assert_failure
+  assert_json_value '.error' 'Profile "bot" does not exist'
+  assert_json_value '.code' 'usage'
+}
+
+@test "basecamp auth login --with-token rejects --device-code" {
+  run basecamp auth login --with-token --device-code </dev/null
+  assert_failure
+  assert_output_contains "with-token"
+}
+
 @test "basecamp auth login rejects --device-code --local" {
   run basecamp auth login --device-code --local
   assert_failure

go.mod

@@ -6,7 +6,7 @@ require (
 	charm.land/bubbles/v2 v2.2.1
 	charm.land/bubbletea/v2 v2.0.9
 	charm.land/lipgloss/v2 v2.0.6
-	github.com/basecamp/basecamp-sdk/go v0.16.0
+	github.com/basecamp/basecamp-sdk/go v0.16.1-0.20260903193203-47e7ca381a49
 	github.com/basecamp/cli v0.2.2-0.20260828230226-767413fc712d
 	github.com/basecamp/mcp v0.0.0-20260828100356-2d6f44b51e9d
 	github.com/basecamp/surfguard/go v0.1.0
@@ -141,7 +141,7 @@ require (
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
-	google.golang.org/grpc v1.83.1 // indirect
+	google.golang.org/grpc v1.83.2 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
 )

go.sum

@@ -87,8 +87,8 @@ github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ
 github.com/aymanbagabas/go-udiff v0.4.1/go.mod h1:0L9PGwj20lrtmEMeyw4WKJ/TMyDtvAoK9bf2u/mNo3w=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
-github.com/basecamp/basecamp-sdk/go v0.16.0 h1:6MfdBf+tgDtfzSHLDhJO9yqsCExNvtWUlK6gzTKzMvM=
-github.com/basecamp/basecamp-sdk/go v0.16.0/go.mod h1:Cs9DV8iRJaVT4+IQXGZTeyG2nQAV2kQda7GHuBOeonY=
+github.com/basecamp/basecamp-sdk/go v0.16.1-0.20260903193203-47e7ca381a49 h1:acgFif/siLT3R1/XWHdXLGGsE4x7HqKCvSaXw6j7xHo=
+github.com/basecamp/basecamp-sdk/go v0.16.1-0.20260903193203-47e7ca381a49/go.mod h1:Cs9DV8iRJaVT4+IQXGZTeyG2nQAV2kQda7GHuBOeonY=
 github.com/basecamp/cli v0.2.2-0.20260828230226-767413fc712d h1:jAzDrCCzDpIwhbFT1xVVs0z2xpXoDEkomHfKB2bUUp8=
 github.com/basecamp/cli v0.2.2-0.20260828230226-767413fc712d/go.mod h1:iTBTaWvsPEFIcZfkxQHEfISyJ6sZ7036K6bNx0RY3EE=
 github.com/basecamp/mcp v0.0.0-20260828100356-2d6f44b51e9d h1:zEQVGq1x1nhKMZ2TudFAcSJ32CHT8richI1vQakIKz4=
@@ -508,8 +508,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:
 google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y=
-google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

internal/appctx/context.go

@@ -47,6 +47,11 @@ type App struct {
 
 	// Flags holds the global flag values
 	Flags GlobalFlags
+
+	// SDKOptions are the client options SDK was built with, so a second
+	// client — one verifying a credential that is not stored yet — rides
+	// the same transport, hooks, and user agent.
+	SDKOptions []basecamp.ClientOption
 }
 
 // GlobalFlags holds values for global CLI flags.
@@ -126,11 +131,12 @@ func NewApp(cfg *config.Config) *App {
 		CacheDir:     cfg.CacheDir,
 		CacheEnabled: cfg.CacheEnabled,
 	}
-	sdkClient := basecamp.NewClient(sdkCfg, &authAdapter{mgr: authMgr},
+	sdkOptions := []basecamp.ClientOption{
 		basecamp.WithHooks(hooks),
 		basecamp.WithTransport(transport),
-		basecamp.WithUserAgent(version.UserAgent()+" "+basecamp.DefaultUserAgent),
-	)
+		basecamp.WithUserAgent(version.UserAgent() + " " + basecamp.DefaultUserAgent),
+	}
+	sdkClient := basecamp.NewClient(sdkCfg, &authAdapter{mgr: authMgr}, sdkOptions...)
 
 	// Create name resolver using SDK client and account ID
 	nameResolver := names.NewResolver(sdkClient, authMgr, cfg.AccountID)
@@ -147,19 +153,31 @@ func NewApp(cfg *config.Config) *App {
 	}
 
 	return &App{
-		Config:    cfg,
-		Auth:      authMgr,
-		SDK:       sdkClient,
-		Names:     nameResolver,
-		Collector: collector,
-		Hooks:     cliHooks,
+		Config:     cfg,
+		Auth:       authMgr,
+		SDK:        sdkClient,
+		SDKOptions: sdkOptions,
+		Names:      nameResolver,
+		Collector:  collector,
+		Hooks:      cliHooks,
 		Output: output.New(output.Options{
 			Format: format,
 			Writer: os.Stdout,
 		}),
 	}
 }
 
+// SDKClientFor returns a client configured like SDK but authenticating with
+// the given provider instead of the stored credential — the way to exercise
+// a token before deciding whether to keep it.
+func (a *App) SDKClientFor(provider basecamp.TokenProvider) *basecamp.Client {
+	cfg := a.SDK.Config()
+	// The effective base URL, not the one SDK was built with: a profile
+	// being created sets its own in memory before its login runs.
+	cfg.BaseURL = a.Config.BaseURL
+	return basecamp.NewClient(&cfg, provider, a.SDKOptions...)
+}
+
 // ApplyFlags applies global flag values to the app configuration.
 func (a *App) ApplyFlags() {
 	// Apply output format from flags (order matters: specific modes first)