edekompile auth helper

Windows command-line login tool for automating bearer retrieval for Edeka. Starts an interactive auth flow in the browser and saves the credentials for usage with other tools like edekompile.

Headless PKCE authenticator. Opens the browser, handles the OAuth callback, exchanges the bearer for long-lived SOAP credentials via edekompile, and writes an auth file that other tools can consume.

Caution

The credentials may authorize in-store payments on your Edeka account. Guard them like a bank card.

• Never paste these tokens into websites, online forms, or third-party tools.
• Read the source of any program you hand them to (including this one).
• If you can't read and understand the source, don't use the tool.

usage

Preferred: run from source so you can see exactly what's executing.

go run .

Or use the provided binary (from releases):

edeka-auth-helper.exe

Browser opens to login.edeka, you sign in, the auth file lands in the working directory, protocol handler is unregistered, process exits. Use -out <path> to write elsewhere (defaults to edeka_auth.json).

how it works

1. Registers itself as the edeka:// handler (HKCU, no admin).
2. Binds a random localhost port, writes it to %TEMP%\edeka-ui-port.
3. Opens the browser to the Keycloak authorization URL with PKCE challenge + state.
4. Keycloak redirects to edeka://main/auth/redirect?code=.... Windows invokes this binary again with the URL as argv[1].
5. The argv-invoked instance reads the port file and forwards the callback via http://localhost:PORT/auth/callback?....
6. The listener exchanges the code for OAuth tokens, then calls edeka.CredentialsFromBearer for SOAP credentials.
7. Writes edeka_auth.json (device config + SOAP credentials) and unregisters the protocol handler.

disclaimer

Same as edekompile: unofficial, unaffiliated with EDEKA ZENTRALE Stiftung & Co. KG, provided for educational and research purposes, use at your own risk.