What is OAuth Device Authorization in the Appwrite CLI?

OAuth Device Authorization is the new login flow for the Appwrite CLI, based on the OAuth 2.0 device authorization pattern. Instead of prompting for your credentials in the terminal, the CLI shows a code and a URL. You confirm the code in your browser, review the requested permissions, and authorize the CLI with your Appwrite account.

Which command starts the new login flow?

The same command as before: `appwrite login`. If you use a self-hosted instance, add the `--endpoint` flag with your instance URL. The only thing that changes is what happens after you run it.

What permissions does the Appwrite CLI request?

The authorization screen lists the exact access you grant: viewing your identity and fully managing your Appwrite account on your behalf. You review and approve these permissions in the browser before the CLI can act.

How do I revoke the CLI's access to my account?

You can revoke access anytime from your Appwrite account settings. Once revoked, the CLI can no longer act on your behalf until you authorize it again.

Does the new login flow affect CI pipelines?

No. Non-interactive mode, which authenticates with an API key through `appwrite client`, is unchanged and remains the recommended approach for CI and scripting.

Announcing OAuth Device Authorization for the Appwrite CLI: Log in from your browser

Signing in to a CLI should not mean typing your account password into a terminal prompt. Your identity already lives in your browser, and that is where authentication should happen.

Today, we are announcing OAuth Device Authorization for the Appwrite CLI. Running appwrite login now hands the sign-in process to your browser, so you can authenticate the CLI with the account session you already trust.

How it works

The new flow follows the OAuth 2.0 device authorization pattern. Run appwrite login, and the CLI displays a device code and a URL, then waits for approval.

The Appwrite CLI displaying a device code and URL

Press Enter to open the URL, or copy it into any browser. Confirm the code on the page matches the one in your terminal and click Continue.

Confirming the device code in the browser

Review the permissions the CLI requests and click Authorize. Once approved, the CLI detects the authorization and finishes signing you in.

Authorizing the Appwrite CLI in the Console

Consent you can see

Before the CLI can act on your behalf, the browser shows you exactly what access you are granting: viewing your identity and fully managing your Appwrite account.

Authorization is also reversible. You can revoke the CLI's access anytime from your Appwrite account settings.

Get started

Update the Appwrite CLI to the latest version and run:

Shell

appwrite login

The CLI installation guide walks through every step with screenshots.

Seeing an email and password prompt instead?

The CLI either needs an update or is pointed at a self-hosted Appwrite instance, which does not support the OAuth device authorization flow. Run appwrite update to get the latest version, or log in with the Appwrite Cloud endpoint explicitly:

Shell

appwrite login --endpoint="https://cloud.appwrite.io/v1"

If a self-hosted endpoint persists, delete prefs.json from the CLI config directory. On macOS and Linux it lives at ~/.appwrite/prefs.json, on Windows at %USERPROFILE%\.appwrite\prefs.json.

Existing authentication flows

API key based authentication is not affected by this change. Existing CLI sessions and non-interactive flows that authenticate with an API key through appwrite client will continue to work, and API keys remain the recommended way to authenticate the CLI in CI workflows. Learn more about non-interactive mode