{
  "video_id": "reddit_1u8ytne",
  "channel_slug": "programming",
  "channel_handle": "r/programming",
  "title": "RFC 8628 fixed CLI login in 2019. Most CLIs still ship the broken version",
  "url": "https://www.reddit.com/r/programming/comments/1u8ytne/rfc_8628_fixed_cli_login_in_2019_most_clis_still/",
  "external_url": "https://www.abgeo.dev/blog/cli-authentication-the-right-way/",
  "upload_date": "20260618",
  "published_at": "2026-06-18T06:41:33+00:00",
  "transcript": "\n\n--- Top Comments ---\n\n\n[108 upvotes] Author here.\n\nMost CLIs (gcloud, wrangler, claude, etc.) log you in by binding an HTTP server on localhost and opening your browser. Works on a laptop. SSH in and it breaks. The \"paste this code\" fallback every one of them ships is a manual device flow in disguise.\n\nRFC 8628 has been the proper fix since 2019. It decouples the device the user authenticates on from the device asking for the token, so the same code path works on a headless box.\n\nThere's a 30-line Go reference at the end if you want to see how the polling loop fits together.\n\n[39 upvotes] This bugs me so much. I had to integrate with a third party that does this, assumes the auth is done on a device where a browser exists. The salt on the wound is that they have a section to integrate their service without user interaction, but still somehow assumes user interaction…\n\nHad to workaround with a http client that stops at the redirect and returns the response body, which will have the code to exchange for a token. \n\n[27 upvotes] Salesforce did the worst of all options. \n\n1. Disable device flow, so you can’t use the phishy fallback  \n2. ERROR OUT EARLY IF THE CLI CANNOT OPEN A BROWSER. This one kills me. You can’t even solve this with SSH port forwarding. If a browser doesn’t exist in your headless environment, then too bad 🤷\n\n[22 upvotes] It brings me no joy to share that this item at the end is outdated:\n\n>`aws sso login` runs device flow end to end against IAM Identity Center.\n\nBest I can tell, `aws sso login` does not default to device flow anymore, [they've added a localhost-based flow and made it default](https://aws.amazon.com/blogs/developer/aws-cli-adds-pkce-based-authorization-for-sso/) to \"shift usage\" off of device flow. AWS acknowledges that the new flow doesn't work on all environments but have so far [refused to let you select it via config file](https://github.com/aws/aws-cli/issues/9098), so you have to specify the flag every time you run `aws sso login`. \n\nIt's a shame because any scripts or tooling around the AWS SSO command have to be prepared to provide the flag in order to work anywhere.",
  "transcript_chars": 2143,
  "ingested_at": "2026-06-18T13:30:16.575928+00:00",
  "source": "reddit",
  "yt_meta": {
    "score": 173,
    "upvote_ratio": 0.88,
    "num_comments": 20,
    "author": "ABGEO",
    "is_self": false
  }
}