[mrctrifork]

Fixes #13.

Problem

PublicClient.create uses an empty API key. PublicClient.authenticateWithCode called the generated UserManagement.authenticateWithCode, which always sets client_secret to the API key. JsonBody.set only skips null, so "client_secret": "" went on the wire and WorkOS answered 422 (client_secret_string_required). Refresh had no public method at all.

Fix

Same approach as workos-ios. Only hand-maintained files change (helpers/PublicClient.kt, HelpersTest.kt); generated UserManagement.kt is untouched.

• PublicClient.authenticateWithCode builds its own body: grant_type, client_id, code, code_verifier.
• New PublicClient.authenticateWithRefreshToken(refreshToken, organizationId = null): grant_type, client_id, refresh_token, organization_id (left out when null).
• Tests check the exact body keys, so client_secret can't come back.

Testing

./script/ci passes (ktlint + tests).

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

PublicClient now builds code and refresh requests without client_secret.

• PublicClient code exchanges now leave out the client secret.
• PublicClient can now exchange refresh tokens without a client secret.

_{Reviews (1) · Last reviewed commit: "fix: PublicClient sends no client_secret..." · Reviewed by Greptile}

[gjtorikian]

d'oh! thanks.