POST /sso/token response lacks expires_in and token_type, breaking workos-python 10.5 get_profile_and_token #129

Summary

The POST /sso/token response (authorization_code grant) has only access_token and profile. workos-python 10.5.0 parses it as SSOTokenResponse, which requires expires_in and declares token_type: "Bearer". Because expires_in is missing, client.sso.get_profile_and_token(code=...) fails, so SSO login can't be completed against the emulator.

Versions

• Emulator: ghcr.io/workos/emulate:0.14.0
• SDK: workos (Python) 10.5.0

Reproduce

Seed with a connection:

organizations:
  - name: Acme Local
    id: org_acme_local
    domains:
      - domain: acme.test
        state: verified
connections:
  - name: Acme SSO
    connection_type: GenericSAML
    organization: Acme Local
    state: active
    domains: [acme.test]
    profiles:
      - email: ada@acme.test
        first_name: Ada

from workos import WorkOSClient

client = WorkOSClient(api_key="sk_test_default", client_id="fake_client_id", base_url="http://localhost:4100")
# code obtained from GET/POST /sso/authorize for ada@acme.test
client.sso.get_profile_and_token(code=code)

Result:

workos._errors.WorkOSError: Unexpected API response while parsing SSOTokenResponse: 'expires_in'

The emulator's response has these top-level keys:

['access_token', 'profile']

Expected

The response should match the API reference and the SDK model (workos/sso/models/sso_token_response.py): token_type: "Bearer", access_token, expires_in (an integer), profile, and optionally oauth_tokens.

Related

#128 (a dsync.activated payload shape that also breaks workos-python 10.5 parsing).