Repository navigation
feat(cli): sign in with an authorization code and PKCE - #221
Merged
Merged
Conversation
`lightning login --device` signs in with the OAuth 2.0 device authorization grant (RFC 8628): it prints a code to enter in a browser on any other device, polls until the sign-in is approved, and saves the session the same way `lightning login` does. When `lightning login` can't open a browser, its error now points at `--device`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Browser login now sends the user to /oidc/authorize for the public lightning-cli client and receives a single-use code on http://127.0.0.1:{port}/callback, exchanged with the PKCE verifier at /oidc/token. `lightning login --no-browser` (and a machine with no browser) uses paste-back through /cli-login instead of the device code flow, which is removed.
vivequeramji
requested review from
dhedey,
ethanwharris,
justusschock,
k223kim,
owbone,
rusenask and
tejapulagam
as code owners
October 29, 2026 17:09
vivequeramji
changed the base branch from
vivequeramji/device-code-login
to
main
October 29, 2026 18:19
vivequeramji
enabled auto-merge (squash)
October 29, 2026 18:19
Keep the PKCE sign-in where it overlaps the device-code login already on main.
UmaMoiseenko
approved these changes
Oct 30, 2026
k223kim
approved these changes
Oct 30, 2026
lianakoleva
approved these changes
Nov 2, 2026
justusschock
approved these changes
Nov 2, 2026
justusschock
disabled auto-merge
November 2, 2026 19:14
ethanwharris
added a commit
that referenced
this pull request
Nov 3, 2026
…IDC_LOGIN is set #221 switched `lightning login` to the authorization-code login, which opens /oidc/authorize. The control plane only serves that with GRID_AUTH_CLI_LOGIN_ENABLED, which production doesn't set yet, so on v2026.11.02 `lightning login` lands on the web app's 404 page. `lightning login` goes back to the v2026.10.27 session-token login by default. LIGHTNING_CLI_OIDC_LOGIN=1 opts in to the authorization-code login, and to `--no-browser`, for testing against an environment that serves it. `--no-browser` is hidden from help and refused without the opt-in, before any saved credentials are cleared. The README and CLI docs no longer mention it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent-Harness: claude-code
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/oidc/authorizefor the publiclightning-cliclient with an S256 challenge andredirect_uri=http://127.0.0.1:{port}/callback. The callback checksstate, exchanges the code and verifier at/oidc/token, saves the session and sends the browser to/cli-login-successful. Anerror, a missing code or a failed exchange sends it to/cli-login-failed.lightning login --no-browser(renamed from--device), and the case where no browser can be opened, use paste-back: the same authorize URL withredirect_uri={LIGHTNING_CLOUD_URL}/cli-login, then a prompt for the code.invalid_grantprompts again, up to three times.login_with_device_code.demo
Tests:
python/tests/cli(the 9 failures intest_deploy.pyandjob/test_list.pyalso fail on the base branch).