Add --client-id flag

README.md

@@ -64,6 +64,8 @@ Follow [these steps](https://docs.github.com/en/developers/apps/creating-a-githu
 
 Compatible with [GitHub Enterprise Server](https://github.com/enterprise).
 
+[GitHub recommends](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app#generating-a-json-web-token-jwt) using your app's **client ID** (rather than the numeric app ID) when authenticating. Both values are accepted by the GitHub API and can be passed via the `--client-id` (preferred) or `--app-id` flag. If both are provided, `--client-id` is used.
+
 ```text
 NAME:
    gh-token - Manage GitHub App installation tokens
@@ -92,7 +94,7 @@ GLOBAL OPTIONS:
 ```shell
 gh token generate \
     --key ./.keys/private-key.pem \
-    --app-id 1122334 \
+    --client-id Iv23aBcD9eFgH1jKlMnO \
     --installation-id 5566778
 ```
 
@@ -115,7 +117,7 @@ gh token generate \
 ```shell
 gh token generate \
     --base64-key $(printf "%s" $APP_KEY | base64) \
-    --app-id 1122334 \
+    --client-id Iv23aBcD9eFgH1jKlMnO \
     --installation-id 5566778
 ```
 
@@ -138,7 +140,7 @@ gh token generate \
 ```shell
 gh token generate \
     --base64-key $(printf "%s" $APP_KEY | base64) \
-    --app-id 1122334 \
+    --client-id Iv23aBcD9eFgH1jKlMnO \
     --installation-id 5566778 \
     --hostname "github.example.com"
 ```
@@ -162,7 +164,7 @@ gh token generate \
 ```shell
 gh token installations \
     --key ./private-key.pem \
-    --app-id 2233445
+    --client-id Iv23aBcD9eFgH1jKlMnO
 ```
 
 <details>
@@ -239,16 +241,18 @@ Successfully revoked installation token
 
 ### Example in a workflow
 
+This follow's [GitHub's guide](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/making-authenticated-api-requests-with-a-github-app-in-a-github-actions-workflow) for using a GitHub App in a GitHub Actions workflow. 
+
 <details>
 
   <summary>Expand to show instructions</summary>
 
 1. You need to create a secret to store the **applications private key** securely (this can be an organization or a repository secret):
     ![Create private key secret](images/create_secret.png)
 
-1. You need to create another secret to store the **application id** security (same as the step above).
+1. Store the **client ID** ([GitHub recommended](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/making-authenticated-api-requests-with-a-github-app-in-a-github-actions-workflow#authenticating-with-a-github-app)), or app ID as a [repository or organization variable](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/store-information-in-variables).
 
-1. The secrets need to be provided as an environment variable then encoded into base64 as show in the workflow example:
+1. The private key secret and client ID variable need to be provided as environment variables. The private key is encoded into base64 as shown in the workflow example below.
 
 This example is designed to run on GitHub Enterprise Server. To use the same workflow with GitHub.com update the hostname to `api.github.com` and change the API URL in the testing step.
 
@@ -266,19 +270,19 @@ jobs:
     steps:
     - name: "Install gh-token"
       run: gh extension install Link-/gh-token
-    # Create access token with a GitHub App ID and Key
+    # Create access token with a GitHub App client ID and key
     # We use the private key stored as a secret and encode it into base64
     # before passing it to gh-token
     - name: "Create access token"
       run: |
         token=$(gh token generate \
           --base64-key $(printf "%s" "$APP_PRIVATE_KEY" | base64 -w 0) \
-          --app-id $APP_ID \
+          --client-id $APP_CLIENT_ID \
           --hostname "github.example.com" \
           | jq -r ".token")
         echo "token=$token" >> $GITHUB_OUTPUT
       env:
-        APP_ID: ${{ secrets.APP_ID }}
+        APP_CLIENT_ID: ${{ vars.APP_CLIENT_ID }}
         APP_PRIVATE_KEY: ${{ secrets.APP_KEY }}
     # To test the token we will use it to fetch the list of repositories
     # belonging to our organization

internal/generate.go

@@ -15,7 +15,10 @@ import (
 
 // Generate is the entrypoint for the generate command
 func Generate(c *cli.Context) error {
-	appID := c.String("app-id")
+	iss, err := resolveIss(c)
+	if err != nil {
+		return err
+	}
 	installationID := c.String("installation-id")
 	keyPath := c.String("key")
 	keyBase64 := c.String("base64-key")
@@ -42,7 +45,6 @@ func Generate(c *cli.Context) error {
 		jwtExpiry = 10
 	}
 
-	var err error
 	var privateKey *rsa.PrivateKey
 	if keyPath != "" {
 		privateKey, err = readKey(keyPath)
@@ -56,7 +58,7 @@ func Generate(c *cli.Context) error {
 		}
 	}
 
-	jsonWebToken, err := generateJWT(appID, jwtExpiry, privateKey)
+	jsonWebToken, err := generateJWT(iss, jwtExpiry, privateKey)
 	if err != nil {
 		return fmt.Errorf("failed generating JWT: %w", err)
 	}
@@ -97,6 +99,16 @@ func Generate(c *cli.Context) error {
 	return nil
 }
 
+func resolveIss(c *cli.Context) (string, error) {
+	if clientID := c.String("client-id"); clientID != "" {
+		return clientID, nil
+	}
+	if appID := c.String("app-id"); appID != "" {
+		return appID, nil
+	}
+	return "", fmt.Errorf("either --client-id or --app-id must be specified")
+}
+
 func retrieveDefaultInstallationID(hostname, jwt string) (string, error) {
 	endpoint := fmt.Sprintf("https://%s/app/installations?per_page=1", hostname)
 	req, err := http.NewRequest("GET", endpoint, nil)

internal/generate_flags.go

@@ -5,10 +5,16 @@ import "github.com/urfave/cli/v2"
 // GenerateFlags returns the CLI flags for the generate command
 func GenerateFlags() []cli.Flag {
 	return []cli.Flag{
+		&cli.StringFlag{
+			Name:     "client-id",
+			Usage:    "GitHub App client ID (preferred)",
+			Required: false,
+			Aliases:  []string{"client_id"},
+		},
 		&cli.StringFlag{
 			Name:     "app-id",
-			Usage:    "GitHub App ID",
-			Required: true,
+			Usage:    "GitHub App app ID",
+			Required: false,
 			Aliases:  []string{"i", "app_id"},
 		},
 		&cli.StringFlag{