---
title: "Get command-line client auth configuration"
method: GET
path: "/cli-auth"
---

# Get command-line client auth configuration

`GET /cli-auth`

The OAuth client configuration for logging a user in from a command-line client. Read this before starting a login: it names the authorization server, the public client id to use, and the loopback ports that are registered as callbacks.

Authorization-code logins must use PKCE — the client is public, so the code verifier is what proves the token request came from the client that started the flow.

## Response `200`

Successful Response

- CliAuthConfiguration — Everything a command-line client needs to run an OAuth login against this deployment. A CLI is pointed at a deployment by URL alone, so it cannot carry a per-deployment client id or callback list of its own — it reads them from here. That also means the registered ports can be widened, or the client rotated, without a CLI release.
  - `issuer` string, required — Authorization server that issues tokens for this API.
  - `client_id` string, required — Public OAuth client id to authenticate as. Not a secret.
  - `audience` string, required — Audience to request, so the token is accepted by this API.
  - `scopes` string[], required — Scopes to request. `offline_access` is what keeps the login alive.
  - `grant_types` string[], required — Grant types this client may use, most preferred first.
  - `loopback_ports` integer[], required — Ports registered as loopback callbacks. Bind the first one that is free and redirect to `http://127.0.0.1:<port>{redirect_path}`. The authorization server does not accept a port outside this list, so fall back to the device-code grant when every one is taken.
  - `redirect_path` string, required — Path component of the registered loopback callback URLs.

---

[API](https://skmtc.dev/layer/apis/layer-rest-api.md) · [All operations](https://skmtc.dev/layer/apis/layer-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/layer/layer-rest-api/revisions/fafc779f9ba2/schema)