Fix org-contacts UUID format and add OrgID troubleshooting guidance

cmd/login.go

@@ -31,6 +31,12 @@ var loginCmd = &cobra.Command{
 			return err
 		}
 
+		// Offer to store OAuth credentials with this user account before saving the token.
+		// This allows each user to have independent client credentials for token refresh.
+		if clientID != "" {
+			promptStoreCredentials(&result.Token, clientID, clientSecret)
+		}
+
 		// Store token in keyring
 		if err := auth.SaveToken(result.Email, &result.Token); err != nil {
 			return fmt.Errorf("saving token: %w", err)
@@ -58,6 +64,34 @@ var loginCmd = &cobra.Command{
 	},
 }
 
+func promptStoreCredentials(tok *auth.StoredToken, clientID, clientSecret string) {
+	var choice string
+	form := huh.NewForm(
+		huh.NewGroup(
+			huh.NewSelect[string]().
+				Title("Save OAuth credentials with this account?").
+				Description(
+					"Storing credentials per-account lets each user refresh tokens independently,\n" +
+						"even when multiple accounts are configured with different OAuth apps.",
+				).
+				Options(
+					huh.NewOption("Yes — save with this account (recommended for multiple users)", "yes"),
+					huh.NewOption("No — use global credentials only", "no"),
+				).
+				Value(&choice),
+		),
+	)
+
+	if err := form.Run(); err != nil {
+		return
+	}
+
+	if choice == "yes" {
+		tok.ClientID = clientID
+		tok.ClientSecret = clientSecret
+	}
+}
+
 func promptFolderAssociation(email, dir string) {
 	folderName := filepath.Base(dir)
 

cmd/root.go

@@ -36,6 +36,12 @@ var rootCmd = &cobra.Command{
 		paginate, _ := cmd.Flags().GetBool("paginate")
 		config.SetPaginate(paginate)
 
+		// Rate-limit retry controls
+		maxRetry, _ := cmd.Flags().GetInt("max-retry")
+		config.SetMaxRetry(maxRetry)
+		maxRetryTimer, _ := cmd.Flags().GetInt("max-retry-timer")
+		config.SetMaxRetryTimer(maxRetryTimer)
+
 		// Load app config early (safe local file read, needed by skipAuth-exempt commands like set-org)
 		cfg, err := appconfig.Load()
 		if err != nil {
@@ -172,6 +178,8 @@ func init() {
 	rootCmd.PersistentFlags().Bool("dry-run", false, "Print write requests without executing them")
 	rootCmd.PersistentFlags().String("user", "", "Use a specific authenticated user (email)")
 	rootCmd.PersistentFlags().String("organization", "", "Override organization ID for this command")
+	rootCmd.PersistentFlags().Int("max-retry", 3, "Max number of 429 retries before giving up (0 = no retries)")
+	rootCmd.PersistentFlags().Int("max-retry-timer", 60, "Max total seconds to wait across all 429 retries (0 = unlimited)")
 
 	// On flag errors (unknown flag, bad value), print usage with valid flags.
 	// SilenceUsage suppresses Cobra's automatic usage, so we print it ourselves.

codegen/generate_cli.py

@@ -222,11 +222,14 @@ def generate_command(ep, group_var, base_url_const, is_calling):
     original_name = ep.get('original_name', cmd_name)
     has_from = any(p['name'] == 'from' for p in query_params)
 
-    # Normalize orgId → orgid for CC commands so auto-populate in root.go works
-    # consistently (CC APIs use UUID format via the --orgid flag path).
+    # Normalize orgId → orgid so auto-populate in root.go resolves to UUID format.
+    # Applies to CC commands (is_calling=False) and to any endpoint under
+    # /contacts/organizations/ which explicitly requires UUID despite being in a
+    # non-CC collection (Postman note: "orgId used in path are the org UUIDs").
     # For path params, rename both the flag and the param key (path uses {orgid}).
     # For query params, only rename the flag; keep the original API key (orgId).
-    if not is_calling:
+    needs_uuid_orgid = not is_calling or '/contacts/organizations/' in path
+    if needs_uuid_orgid:
         path = path.replace('{orgId}', '{orgid}')
         for p in path_params:
             if p['name'] == 'orgId':

internal/auth/keyring.go

@@ -17,6 +17,8 @@ type StoredToken struct {
 	ExpiresAt    time.Time `json:"expires_at"`
 	TokenType    string    `json:"token_type"`
 	IssuedAt     time.Time `json:"issued_at"`
+	ClientID     string    `json:"client_id,omitempty"`
+	ClientSecret string    `json:"client_secret,omitempty"`
 }
 
 // IsExpired returns true if the access token is expired or within 60s of expiry.

internal/auth/resolve.go

@@ -71,12 +71,14 @@ func ResolveToken(flagToken, envToken, userFlag, envUser string, cfg *appconfig.
 
 	// Auto-refresh if expired
 	if tok.IsExpired() {
-		clientID := cfg.EffectiveClientID()
-		clientSecret := cfg.EffectiveClientSecret()
+		clientID, clientSecret := effectiveCredentials(tok, cfg)
 		refreshed, err := RefreshAccessToken(clientID, clientSecret, tok)
 		if err != nil {
 			return nil, fmt.Errorf("token expired for %s and refresh failed: %w\nRun: webex login", email, err)
 		}
+		// Carry per-token credentials forward into the refreshed token
+		refreshed.ClientID = tok.ClientID
+		refreshed.ClientSecret = tok.ClientSecret
 		tok = refreshed
 		// Persist the refreshed token
 		if saveErr := SaveToken(email, tok); saveErr != nil {
@@ -105,13 +107,25 @@ func MakeRefresher(email string, cfg *appconfig.Config) func() (string, error) {
 		if err != nil {
 			return "", err
 		}
-		refreshed, err := RefreshAccessToken(cfg.EffectiveClientID(), cfg.EffectiveClientSecret(), tok)
+		clientID, clientSecret := effectiveCredentials(tok, cfg)
+		refreshed, err := RefreshAccessToken(clientID, clientSecret, tok)
 		if err != nil {
 			return "", err
 		}
+		refreshed.ClientID = tok.ClientID
+		refreshed.ClientSecret = tok.ClientSecret
 		if saveErr := SaveToken(email, refreshed); saveErr != nil {
 			fmt.Printf("Warning: could not save refreshed token: %v\n", saveErr)
 		}
 		return refreshed.AccessToken, nil
 	}
 }
+
+// effectiveCredentials returns the client ID and secret to use for token refresh.
+// Per-token credentials (stored with the user account) take priority over global config.
+func effectiveCredentials(tok *StoredToken, cfg *appconfig.Config) (clientID, clientSecret string) {
+	if tok.ClientID != "" {
+		return tok.ClientID, tok.ClientSecret
+	}
+	return cfg.EffectiveClientID(), cfg.EffectiveClientSecret()
+}