> For clean Markdown content of this page, append .md to this URL. For the complete documentation index, see https://buildwithfern.com/learn/llms.txt.

## Browser and device login

auth, generators.yml

Generated CLIs can now log users in interactively. Declaring an `authorization-code` scheme gives `<bin> auth login` a browser flow with PKCE, and a `device-code` scheme prints a user code for machines without a browser, such as SSH sessions and containers. Tokens are stored in the OS keyring, refreshed when they expire, and sent on every request. `auth logout` clears them and `auth status` shows which schemes have a credential.

**`generators.yml`**

```yaml title="generators.yml"
auth-schemes:
  OAuth:
    scheme: oauth
    type: authorization-code
    client-id: my-public-client-id
    authorization-url: https://idp.example.com/authorize
    token-url: https://idp.example.com/oauth/token
```

Omitting `redirect-uri` binds an OS-assigned loopback port at login. Pin the callback host, path, and port instead by setting one explicitly, with backup ports tried in order when the primary is busy. Authorization servers that need extra literal parameters, such as an Auth0 `audience`, accept them through per-request parameter maps.

Read the docs