internal/client/management.go

@@ -204,7 +204,8 @@ type MintWorkspaceTokenResponse struct {
 // (POST /workspaces/:id/tokens). Plaintext is returned exactly once.
 func (p *Platform) MintWorkspaceToken(id string) (*MintWorkspaceTokenResponse, error) {
 	var out MintWorkspaceTokenResponse
-	if err := p.postInto("/workspaces/"+url.PathEscape(id)+"/tokens", nil, &out); err != nil {
+	// Pass empty object rather than nil so the body is {} not null.
+	if err := p.postInto("/workspaces/"+url.PathEscape(id)+"/tokens", map[string]interface{}{}, &out); err != nil {
 		return nil, err
 	}
 	return &out, nil

internal/cmd/root.go

@@ -57,6 +57,11 @@ func init() {
 		"Shorthand for --output json")
 	rootCmd.PersistentFlags().StringVar(&configPath, "config", "",
 		"Path to config file (default ~/.config/molecule.yaml or ./molecule.yaml)")
+	// Bind flags to viper so config-file / env values can override defaults.
+	_ = viper.BindPFlag("api_url", rootCmd.PersistentFlags().Lookup("api-url"))
+	_ = viper.BindPFlag("verbose", rootCmd.PersistentFlags().Lookup("verbose"))
+	_ = viper.BindPFlag("output", rootCmd.PersistentFlags().Lookup("output"))
+	_ = viper.BindPFlag("json", rootCmd.PersistentFlags().Lookup("json"))
 	// --json wins over -o; resolved before any command runs.
 	rootCmd.PersistentPreRun = func(_ *cobra.Command, _ []string) {
 		if jsonOutput {
@@ -82,6 +87,22 @@ func Execute() error {
 	viper.AutomaticEnv()
 	_ = viper.ReadInConfig() // ignore not-found; env vars win
 
+	// Sync config-file / env values back into the globals so cobra flags
+	// reflect the full viper precedence chain (flag > env > config > default).
+	if v := viper.GetString("api_url"); v != "" {
+		apiURL = v
+	}
+	if viper.GetBool("verbose") {
+		verbose = true
+	}
+	if v := viper.GetString("output"); v != "" {
+		outputFormat = v
+	}
+	if viper.GetBool("json") {
+		jsonOutput = true
+		outputFormat = "json"
+	}
+
 	// rootCmd has SilenceErrors=true, so cobra prints nothing on error.
 	// Route the error through handleErr so user-facing messages (including
 	// exitError fail-fast guidance like the org-verb credential errors) are