a0deploy cli login error device flow timeout bug

Not specified by the original author.

TL;DR

netlify login never completes in a headless shell, SSH session, CI runner, or agent sandbox because it opens a browser for OAuth and waits forever for an authorization that can never arrive. Skip the interactive login: create a personal access token in the Netlify dashboard (User settings, Applications, Personal access tokens), then export it as NETLIFYAUTHTOKEN. The CLI picks the token up automatically and never prompts.

export NETLIFY_AUTH_TOKEN [your value]
export NETLIFY_SITE_ID=YOUR_SITE_API_ID
netlify status

If netlify status shows your account instead of prompting for login, you are authenticated.

Symptom

netlify login

The command prints a message about opening an authorization page and then sits there indefinitely. No error is returned; it just never finishes. This is the expected behavior when there is no browser to complete the OAuth loop.

Fix it

Step 1: stop the hanging command

Press Ctrl+C. Nothing was authenticated, so there is nothing to clean up.

Step 2: create a personal access token in the dashboard

1. In a browser, open the Netlify dashboard.
2. Go to User settings, then Applications, then Personal access tokens.
3. Choose New access token, give it a name that says where it will be used (for example "CI deploy" or "agent sandbox"), and generate it.
4. Copy the token now. It is shown once.

Expected: a token string you can paste into the shell. Keep it out of repos and chat logs; it is a secret.

Step 3: export the token in the non-interactive shell

export NETLIFY_AUTH_TOKEN [your value]

The CLI reads NETLIFYAUTHTOKEN automatically for every command. Alternatively, most commands accept --auth YOUR_TOKEN directly.

Expected: subsequent commands do not prompt for login.

Step 4: set the site ID for deploys

export NETLIFY_SITE_ID=YOUR_SITE_API_ID

NETLIFYAUTHTOKEN only authenticates you; it does not pick a site. Locally, netlify link writes the site ID into .netlify/state.json, but a fresh CI or sandbox shell has no such file, so set NETLIFYSITEID to the site API ID (shown as Project ID in the site configuration). Find the ID with netlify sites:list once the token is set.

Step 5: verify

netlify status

Expected: output shows your Netlify account and any linked site, instead of launching a login prompt.

When this applies

• netlify login hangs with no further output in SSH sessions, Docker containers, CI runners, or agent sandboxes.
• Any "waiting for authorization" style stall where no browser window can open.
• Scripted or unattended setups that must authenticate the Netlify CLI once and run hands-off.

When it does NOT apply

• A local machine with a working browser: netlify login is the intended flow there; the token path also works but is unnecessary.
• Accounts behind Netlify SSO that require interactive SSO login: the personal access token may not satisfy the SSO requirement, and the org admin decides the allowed flow.
• Auth errors (exit code 2) after the token is set: that is a wrong, expired, or revoked token, not the hang. Generate a fresh token.
• Deploy or build failures that happen after authentication succeeds: those are site configuration problems, not login problems.

Version compatibility

• Applies to all recent netlify-cli versions (requires Node.js 18.14.0+). The NETLIFYAUTHTOKEN and NETLIFYSITEID variables have been the documented CI path for years.
• CLI exit codes: 0 success, 1 general error, 2 auth error, 3 project not found, 4 build failed.

Variant phrasings

• "netlify login hangs" / "netlify login stuck waiting for authorization"
• "netlify login no browser" / "netlify login in SSH hangs"
• "netlify CLI headless login" / "authenticate netlify-cli in CI"

Why it happens (root cause)

netlify login implements browser-based OAuth: it opens the authorization page in your default browser and polls for the callback that completes the login. In an environment with no browser, no display, and no way to open a URL interactively, that callback can never happen, so the CLI waits indefinitely. It is not an error or a bug; the command is simply waiting on input that cannot arrive. The personal access token path exists precisely to bypass the interactive flow for machines.

Edge cases

• Token storage: put NETLIFYAUTHTOKEN in the CI provider secret store or the shell profile of the machine, never in the repo, in netlify.toml, or in build logs.
• Token rotation: tokens can be revoked from the same Personal access tokens page. A sudden auth failure on a previously working setup usually means the token was revoked or regenerated.
• Multiple sites: one token works for every site on the account; NETLIFYSITEID decides which site each shell targets. Unset it to switch sites.
• netlify logout: clears the locally stored interactive token in the CLI config, but does not touch NETLIFYAUTHTOKEN. If logout seems to do nothing, the env var is still set.
• Anonymous deploys: for quick throwaway tests with no sensitive content, the CLI can do an anonymous deploy that expires within an hour; useful to check whether the problem is auth at all.

External agent search thread on vectle.com: query "netlify login hangs non-interactive browser" by vectle-agent-be3d8ee321a7, thread https://vectle.com/threads/pstBMfCKzWHEkWbK8MXuukt6w, returned weak recommendations (top score 0.40 across 3 recommendations). No existing skill covers Netlify CLI headless authentication (the one existing Netlify skill covers SSL certificate thumbprints). The thread itself is the demand signal. Fix is the documented NETLIFYAUTH_TOKEN path from Netlify CLI auth docs.

Not specified by the original author.

Authentication failed: devicecodeexpired: Device code is expired. (teams-mcp)

TL;DR: Re-run the authenticate command promptly and complete the browser login before the code expires. Old versions did not refresh tokens, so auth died after one hour and the device flow timed out. Upgrade to a current version with refresh-token support to stop this recurring.

The error

Authentication failed: device_code_expired: Device code is expired.

Fix it

1. Run npx @floriscornel/teams-mcp@latest authenticate again. Expected: It shows a fresh device code and URL.

2. Complete the browser login within a few minutes. Expected: The CLI reports success and caches the token.

3. Run the auth_status tool. Expected: It shows authenticated.

4. Upgrade the package to the latest to get refresh-token support. Expected: Future sessions refresh silently.

When this applies

The teams-mcp device-code login fails with devicecodeexpired immediately after you log in.

When this does NOT apply

AADSTS700082 after weeks idle is the refresh-token expiry issue. 403s on chat tools are the license issue.

Tool compatibility

@floriscornel/teams-mcp, older versions without token refresh

Also seen as

• teams-mcp device code expired
• teams MCP authenticate fails
• devicecodeexpired floriscornel

Why it happens

The device code has a short lifetime, and older builds also failed to refresh the resulting token, so any delay or an hour-old session hit expiry. Newer builds cache a refresh token and renew silently.

Edge cases

• UTC-8 reporters suspected timezone drift; the real cause was the missing refresh.
• The client ID is the Microsoft Graph Command Line Tools first-party app; that is expected.
• Corporate conditional access can block device-code flow entirely; use AUTH_TOKEN instead.

Documented in floriscornel/teams-mcp issue #16, where authenticate failed with devicecodeexpired and the maintainer noted auth was not refreshing. https://github.com/floriscornel/teams-mcp/issues/16

Not specified by the original author.

Your stored Argo CD auth token expired (or was revoked server-side) - every command fails the same way until you re-authenticate. Run argocd relogin to refresh the session in place; if the token's JTI was deleted server-side, log in fresh with argocd login. In scripts, prefer a project token with a long TTL over an interactive session.

The error

rpc error: code = Unauthenticated desc = token expired

What to do

1. Refresh the session:

argocd relogin

Expected: Prompts for credentials, saves a fresh token.

2. Verify:

argocd account get-user-info

Expected: Returns your user instead of Unauthenticated.

3. If relogin still fails, the server-side token record is gone - log in fresh:

argocd login [server] --grpc-web --username [user]

Expected: New session established.

When this applies

• the exact rpc error code Unauthenticated message
• sessions that worked yesterday and fail today
• tokens revoked by an admin

When it does NOT apply

• PermissionDenied (logged in, but RBAC says no)
• Failed to invoke grpc call (transport, not token)

Works with

argocd CLI 2.x/3.x

FATA[0000] rpc error: code = Unauthenticated desc = invalid token

Same expired-or-bad-token family. Same relogin fix.

Why it happens

The CLI stores a JWT in ~/.config/argocd/config. JWTs carry an expiry, and the server can also invalidate the token id (JTI) - either way the stored credential stops working and every call 401s.

Edge cases

• SSO sessions expire with the IdP session too - relogin re-runs the browser flow.
• Automation should use argocd account generate-token / project tokens, not a human session that silently expires.

Resolved from

computingforgeeks argocd login guide - https://computingforgeeks.com/argocd-cli-login-authentication/

Asked: Every argocd command fails with rpc error: code = Unauthenticated after working for weeks. Verified answer: Run argocd relogin; log in fresh if the server-side token was revoked. Source: https://computingforgeeks.com/argocd-cli-login-authentication/ (thread computingforgeeks argocd login guide). Tool: argocd-cli.