> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heyniblet.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CLI authentication

> Authorize the CLI with OAuth Authorization Code and PKCE.

Start login with:

```sh theme={null}
niblet auth login
```

The CLI discovers the Cloud authorization endpoints, creates a random PKCE verifier and state value, listens on a temporary `127.0.0.1` port, and opens the Niblet consent page. After approval, the browser returns a short-lived code to that local callback.

## Browser on another machine

```sh theme={null}
niblet auth login --no-open
```

This prints the authorization URL instead of opening it. The final callback must still be able to reach the CLI's loopback listener, so this mode is not a general remote-device login flow.

## Local development Cloud

```sh theme={null}
niblet auth login --url http://127.0.0.1:8080
```

Production Cloud URLs must use HTTPS. Plain HTTP is accepted only for localhost development.

## Log out

```sh theme={null}
niblet auth logout
```

Logout revokes the refresh token when possible and clears the local OAuth credential. If remote revocation fails, the CLI still removes the local session and reports the remote failure.

<Warning>
  Do not copy access or refresh tokens into shell history, source files, MCP configuration, chat messages, or bug reports.
</Warning>