b1f8de3b · zzmq.dev@gmail.com/zz
Commit
b1f8de3bda6b35ba21ea97827e819558b1282a1c
Fix: Cloudflare login now gets real email, not just an opaque sub The OIDC-shaped /oauth2/userinfo genuinely has no profile fields, but the same OAuth access token also works as a Bearer token against the real REST API -- GET /client/v4/user, confirmed live via /dev-cf-userinfo-raw, returns the account's real email (and first/last name when set). Only email/first_name/last_name/username are extracted; the rest of that response (org membership, the full permissions list, billing flags) is deliberately not stored. Display name prefers full name, then email, then username last -- Cloudflare's `username` turned out to be another opaque generated hash when no first/last name is set, confirmed live, no more readable than the account id. Also: account profile (display_name/email) now refreshes on every login, not just first signup -- a provider's profile data can be missing or wrong at signup and fill in or correct itself later (exactly what happened here switching from /oauth2/userinfo to /client/v4/user mid-session). Verified live: re-logging in with Cloudflare now lands on /profile showing thoward37@gmail.com instead of a raw hex id. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Troy Howard <thoward37@gmail.com> -- 2026-10-12T01:37:00.000Z