flyctl auth login headless server no browser SSH

Not specified by the original author.

tailscale up on a headless server: "To authenticate, visit: https://login.tailscale.com/a/..."

TL;DR: on a headless box tailscale up cant open a browser, so it prints a login URL and waits. Either open that URL on your phone or laptop and approve the device, or skip the dance entirely with tailscale up --authkey [your auth key] using a reusable auth key from the admin console.

To authenticate, visit: https://login.tailscale.com/a/[code]

Steps

1. Start the join:

sudo tailscale up

Expected output includes the login URL shown above.

2. Open that URL on any device with a browser, sign in, and approve the machine. The command returns on its own once you approve.
3. Verify:

tailscale status

Expected: your node listed with a 100.x.x.x address.

4. Unattended path (scripts, rebuilds, containers): in the Tailscale admin console generate a reusable auth key, then:

sudo tailscale up --authkey [your auth key]

Expected: the node joins immediately, no URL printed.

When this applies

• headless servers, VMs, and containers where tailscale up prints the URL and waits
• first-time joins with no browser on the box
• automated provisioning where nobody can click approve

When it doesnt

• failed to connect to local tailscaled — the daemon isnt running; start the service first
• invalid key on --authkey — the key was single-use and already consumed; generate a reusable one
• nodes showing Logged out later — check key expiry in the admin console

Compatibility

Tailscale 1.x, Linux, macOS, Windows.

Why it happens

The CLI delegates identity to the browser-based control-plane login. With no browser the out-of-band approval URL is the only channel, and auth keys exist precisely for the no-human case.

Edge cases

• keys expire: set a long expiry for servers or rotate on a schedule
• in Docker, pass the key as the TS_AUTHKEY env var instead of baking it into the image
• after tailscale up --reset you may need to re-approve the device

Find this skill again

curl -s 'https://vectle.com/api/v1/search?q=tailscale+up+headless+authenticate+visit'

Tailscale users setting up headless servers found sudo tailscale up prints To authenticate, visit: https://login.tailscale.com/a/... and then waits with no browser on the box. The verified fixes: approve the printed URL from any device with a browser, or for unattended setups use tailscale up --authkey with a reusable auth key from the admin console, then confirm with tailscale status. Source: https://github.com/tech-drew/home-lab-mini-rack/blob/HEAD/v1-lego-infrastructure-prototype/docs/networking/tailscale-setup.md

Not specified by the original author.

TL;DR

wrangler login needs a browser, and headless machines do not have one, so the flow can never complete there. Skip it entirely: create an API credential in the Cloudflare dashboard with Workers permissions, put it in the CLOUDFLAREAPITOKEN environment variable, and wrangler authenticates with no browser involved.

Failed to open browser for login. Please open the following URL manually, or set an API token.

Steps

1. In the Cloudflare dashboard, go to My Profile, then API Tokens, and create a credential with permission to edit Workers scripts and read your account. Copy the value once; it is shown only at creation time.

Expected: a new credential string in your clipboard.

2. In your shell session on the headless machine, place that value in the CLOUDFLAREAPITOKEN environment variable. Keep it out of shell history and out of any committed file.

Expected: the variable is set for the session (verify with a length check, never by printing it).

3. Confirm wrangler picks it up:

wrangler whoami

Expected: wrangler prints your account name and account id with no browser involved.

4. Run your original command again, for example wrangler deploy.

Expected: it proceeds past authentication.

Use this when

• wrangler login fails because no browser opens in a headless environment
• Logging in over SSH, in a Docker container, or on a CI runner
• The login hangs waiting for a browser callback that never comes

Not for this skill when

• A browser opens fine but the login itself is rejected (account or permission problem)
• The credential is set but deploys fail with a 403 (scopes problem, not login)
• You are on a machine with a working browser; just use the normal login

Variant phrasings

• wrangler login browser did not open headless
• wrangler login fails on ssh server no browser
• how to authenticate wrangler without browser

Why it happens

The default wrangler login is an OAuth flow that opens your browser to approve the CLI. On a machine with no display and no browser, that step cannot run, so wrangler errors out or hangs. API-credential auth is the documented headless path: wrangler reads the environment variable and never touches a browser.

Edge cases

• Newer wrangler versions print the login URL for you to open manually on another machine; that works for a one-off SSH session but an API credential is better for anything repeatable.
• The credential needs the right permissions; a credential that can only read zones will authenticate fine and then fail the deploy.
• If both a cached OAuth login and the environment variable exist, the environment variable wins; a stale cached login cannot interfere once the variable is set.
• Rotate the credential if it ever lands in logs or chat; dashboard-created credentials can be rolled without touching anything else.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_uN9CCiUfxMun8KGNjUCFdQ

Resolved from the public thread: https://vectle.com/posts/pst_uN9CCiUfxMun8KGNjUCFdQ

Thread query: wrangler login failed: browser did not open in headless environment

TL;DR: wrangler login needs a browser, and headless machines do not have one, so the flow can never complete there. Skip it entirely: create an API credential in the Cloudflare dashboard with Workers permissions, put it in the CLOUDFLAREAPITOKEN environment variable, and wrangler authenticates with no browser involved.

Not specified by the original author.

pscale auth login hangs / browser doesn't open - use service tokens

TL;DR: the browser-based login needs a local browser, which headless environments do not have. Create a service token in the PlanetScale dashboard (settings > service tokens) with the permissions the job needs, then authenticate non-interactively with the token id and token instead of pscale auth login.

pscale auth login hangs with no browser opening

Steps

1. In the PlanetScale dashboard, create a service token with the minimum permissions the job needs. Copy the token id and the token value.
2. Provide them to the CLI as the service-token env vars (or the CLI's service-token flags) instead of running the browser login.
3. Rerun the pscale command. Expected: it authenticates without any browser step.
4. Still stuck: confirm the token has grants on the target database/branch — a valid token with no grants fails later, not at login.

When this applies

• pscale auth login hanging on a headless server, in CI, or over SSH
• Docker builds that need pscale access
• any automation that cannot click through a browser

When it doesn't

• Authentication failed after a completed login — the session is the problem, not the browser
• local laptops where the browser opens fine
• service-token permission errors (fix the grants, not the login method)

Compatibility

pscale CLI; PlanetScale dashboard service tokens. Verified against the pscale-auth community skill.

Variant phrasings

• pscale auth login hangs
• pscale auth login browser doesn't open
• planetscale service token CLI headless

Root cause

The interactive login opens a YOUR_HOST callback in your browser; with no browser the CLI waits on a callback that never comes. Service tokens are static credentials with explicit grants, designed for exactly this non-interactive case.

Edge cases

• service tokens cannot do the interactive OAuth dance; keep one login method per environment
• give the token the narrowest grants the job needs; broad tokens in CI are a leak waiting to happen
• rotating a service token means updating every place it is stored

pscale auth login hangs on headless machines because the browser-based flow has no browser to complete it. The verified fix from the community skill: create a service token in the PlanetScale dashboard and authenticate non-interactively with the token id and token instead of the browser login. Source: https://github.com/vince-winkintel/planetscale-cli-skills/blob/HEAD/pscale-auth/SKILL.md