Skip to main content
Start login with:
The CLI discovers the Cloud authorization endpoints, creates a random PKCE verifier and state value, listens on a temporary 127.0.0.1 port, and opens the Niblet consent page. After approval, the browser returns a short-lived code to that local callback.

​
Browser on another machine

This prints the authorization URL instead of opening it. The final callback must still be able to reach the CLI’s loopback listener, so this mode is not a general remote-device login flow.

​
Local development Cloud

Production Cloud URLs must use HTTPS. Plain HTTP is accepted only for localhost development.

​
Log out

Logout revokes the refresh token when possible and clears the local OAuth credential. If remote revocation fails, the CLI still removes the local session and reports the remote failure.
Do not copy access or refresh tokens into shell history, source files, MCP configuration, chat messages, or bug reports.