Add --decode flag to get-access-token CLI

[Michel Edkrantz (MichelEdkrantz)]

Summary

• Adds a --decode flag to kognic-auth get-access-token that decodes and pretty-prints the full JWT structure (header, payload, and signature) instead of printing the raw token
• Output includes decoded header (e.g. algorithm), decoded payload (sub, exp, scopes, etc.), and the raw signature
• Useful for quickly inspecting tokens without external tools

Example output

{
  "header": {
    "alg": "RS256"
  },
  "payload": {
    "sub": "user123",
    "exp": 9999999999
  },
  "signature": "base64url-encoded-signature"
}

Test plan

• uv run pytest tests/test_cli.py — all tests pass
• Manual test: kognic-auth get-access-token --decode prints full JWT structure
• Manual test: kognic-auth get-access-token (without --decode) still prints raw token

🤖 Generated with Claude Code