---
title: "Cli Start"
method: GET
path: "/auth/cli/start"
tags: ["auth"]
---

# Cli Start

`GET /auth/cli/start`

Build the WorkOS authorization URL for the loopback login flow.

The returned URL redirects (after WorkOS login) to ``/auth/cli/callback`` with
a signed ``state`` carrying the loopback port + PKCE challenge. ``screen_hint``
only picks which AuthKit tab opens first (``nanocorp signup`` sends
``sign-up``); the find-or-create callback is identical for both verbs.

## Query parameters

- `port` integer, required — Loopback port the one-time code will be 302'd to
- `code_challenge` string, required — PKCE S256 challenge (base64url, no padding)
- `env` string, nullable
- `screen_hint` string, nullable — AuthKit tab to default to: 'sign-up' (signup) or 'sign-in' (login). Junk is ignored.

## Response `200`

Successful Response

- CliStartResponse
  - `authorization_url` string, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/nanocorp/apis/nanocorp-api.md) · [All operations](https://skmtc.dev/nanocorp/apis/nanocorp-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/nanocorp/nanocorp-api/revisions/04b208d3215b/schema)