---
title: "Complete a CLI sign-in that WorkOS paused for organization selection"
method: POST
path: "/v1/auth/cli/select-organization"
tags: ["Auth"]
---

# Complete a CLI sign-in that WorkOS paused for organization selection

`POST /v1/auth/cli/select-organization`

The CLI exchanges its loopback authorization code directly with WorkOS. For a user who belongs to an organization, WorkOS answers that exchange with `organization_selection_required` and a pending authentication token, and the grant that resolves it requires the client secret the CLI must not hold. This route completes that grant for the organization the user chose on the approve page and returns the resulting tokens. WorkOS enforces that the organization is one of the user's memberships.

## Request body

- object
  - `pendingAuthenticationToken` string, required
  - `organizationId` string, uuid, required

## Response `200`

Default Response

- object
  - `links` object, required
    - `self` string, uri, required
  - `data` object, required
    - `id` string, required
    - `type` 'cli-authentication', required
    - `attributes` object, required
      - `accessToken` string, required
      - `refreshToken` string, required
      - `user` object, required
        - `id` string, required
        - `email` string, required
        - `firstName` string, nullable, required
        - `lastName` string, nullable, required

## Other responses

- `401` — Unauthorized
- `404` — Not Found
- `500` — Internal Server Error
- `503` — Service Unavailable

## Changes

- **2026-08-28** `d1ef4ac0815d` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/tessl/apis/tessl-api/changes/v1/auth/cli/select-organization/post.md)

---

[API](https://skmtc.dev/tessl/apis/tessl-api.md) · [All operations](https://skmtc.dev/tessl/apis/tessl-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/tessl/tessl-api/revisions/11217e48a1a9/schema)