Authenticate without a browser

[gianarb]

From @scotwells:

Authenticate without a browser - The authentication process relies on the user having a browser on the same host as datumctl to handle the OAuth code exchange challenge. Ideally we would also support users being able to receive a code in a browser on another computer that they can feed into the CLI's authentication process so it can complete the code challenge. Google and other providers have this capability.

[gianarb]

@scotwells the mcp code exposes this environment variable DATUM_TOKEN

https://github.com/datum-cloud/datum-mcp/blob/9b2f76a09c48879bac675f643fd930de2d7bae14/internal/auth/ensure.go#L11-L45

It skips the recover from keychain and browser.

Is this what you have in mind? If so I can add the flag to our list of supported flags. Something like --auth-token?

Or should we use the kubectl

--token="" Bearer token for authentication to the API server

we have disabled during code review?

[scotwells]

@gianarb the goal here was to enable users to complete the OAuth flow by providing the code issued by the authorization server to complete the auth exchange instead of needing to redirect back to a browser URL. One good example of this is the gcloud CLI which prompts you for the code the auth server provides:

$ gcloud auth login --update-adc --no-launch-browser
Go to the following link in your browser, and complete the sign-in prompts:

    https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=...

Once finished, enter the verification code provided in your browser: 

After completing authentication at the URL provided, I'm given a code I can copy / paste into the terminal:

[gianarb]

@scotwells does this work for you?!

https://zitadel.com/docs/guides/integrate/login/oidc/device-authorization

Can we enable such feature for our organization in Zitadel? It is not what you reported by gcloud but it sounds similar. If you want the token itself I will keep digging

[scotwells]

@gianarb that could be an interesting approach! I wonder if we can have the code auto-fill on the zitadel side by baking it into the URL so the user wouldn't need to copy it.

For Zitadel, looks like we might need to configure a new oauth client? I can look at getting one setup for testing

[gianarb]

Yeah we need to configure the client and I read somewhere that it is possible to pass the code via URL. I will try Il 15 febbraio 2026 02:25:51 CET, Scot Schuchert-Wells ***@***.***> ha scritto:

…

scotwells left a comment (datum-cloud/datumctl#104) @gianarb that could be an interesting approach! I wonder if we can have the code auto-fill on the zitadel side by baking it into the URL so the user wouldn't need to copy it. For Zitadel, looks like we might need to configure a new oauth client? I can look at getting one setup for testing -- Reply to this email directly or view it on GitHub: #104 (comment) You are receiving this because you were mentioned. Message ID: ***@***.***>