diff --git a/.optimize-cache.json b/.optimize-cache.json index b68b74a2a4..495fd66bf4 100644 --- a/.optimize-cache.json +++ b/.optimize-cache.json @@ -212,6 +212,7 @@ "static/images/blog/announcing-bun-and-dart/bun-and-dart.png": "ea94af00a5c035cefb6474a9061441803db0160b7cc194fb5a71fbe05abf0d12", "static/images/blog/announcing-bun-deno-runtimes/cover.png": "5c739aa57624b990174943108de2433dd9292798d9e488d01351d5f01eba7800", "static/images/blog/announcing-bun-deno-runtimes/runtime-bun.png": "3ca689b349526e34386ac8dac25eb3ced20952c4493a85800da848a4e81fe319", + "static/images/blog/announcing-cli-device-authorization/cover.png": "c3aa85031950dad67dfcc14d687766ee40ee9f684bdb56791872c43bbb3ffc38", "static/images/blog/announcing-cname-flattening/cover.png": "3d79ccb4a7f1bac9e32e0456e31fe09f4475e87368e582591799445a7d4a6f3a", "static/images/blog/announcing-csv-export/cover.png": "a330a6cc463d94635f905f5b48e6ee8b7c1b3f48b1c7ca0fada2e2b6f62b4ccf", "static/images/blog/announcing-csv-imports/cover.png": "47b77b504bdb691afcdf7769b70a5edc610ad525364bff8747d813cc674d549c", @@ -1470,6 +1471,13 @@ "static/images/docs/auth/ssr/ssr.png": "a9a58a3a053dbfec7eef50894d973049254ac9af4ed7159f93a5dd95dc0faf94", "static/images/docs/command-center/command-center.png": "4e32c190ab1fbc74040c43b2d85a8404af9b553bb9672c1a842fee92ecd48b31", "static/images/docs/command-center/dark/command-center.png": "d3c26f78c419d22fa9779baf884561ac117a0597347310e54e6ee14c972c8a11", + "static/images/docs/command-line/cli-login-authorize.png": "2aa6671d82af9c66fee500f6f8e1b1ba1c59a8e29ecc4fb36c8600d1eb52f1dd", + "static/images/docs/command-line/cli-login-confirm-code.png": "0a3e03c35fb8be0cbbce52820a96df10897739ff628e1514ade2118e68b0a1af", + "static/images/docs/command-line/cli-login-device-connected.png": "74e5537076aca6e1fd5ed2b228a45baa06562df2fef11a80087a85446d70620d", + "static/images/docs/command-line/cli-login-terminal.png": "e0e7937e0eb5f92806caf6be0e0389ed01f80d44cc62e075d9943e355feaa2f3", + "static/images/docs/command-line/dark/cli-login-authorize.png": "5792cbbf2886618b8db4e90f4b0f7a411a3bd48390ac3871d16c1fa199ffc7d8", + "static/images/docs/command-line/dark/cli-login-confirm-code.png": "b7acfc07697c241e056765603e421d7b3c31caf3c08e8efd32e2da5b60580d05", + "static/images/docs/command-line/dark/cli-login-device-connected.png": "f990ce61579a61ab20f636d4f10870e15bfd89c173f64e468462e1363cc30d90", "static/images/docs/databases/ai-suggestions-enable.png": "d331d502fb141cf28478cad2b2e96f0e622eae9c97625976c756ff52343dad77", "static/images/docs/databases/ai-suggestions-review.png": "9796a6afa6164126acdfea67561c560fade3d39e51d2fec6bd9d6cf034ef0aa1", "static/images/docs/databases/csv-export.png": "978aeeb301b9d7571793a5184fe955dae7a8a3ab7fbd0c613b12ccac73d51980", diff --git a/src/routes/blog/post/announcing-cli-device-authorization/+page.markdoc b/src/routes/blog/post/announcing-cli-device-authorization/+page.markdoc new file mode 100644 index 0000000000..9d1350cf0d --- /dev/null +++ b/src/routes/blog/post/announcing-cli-device-authorization/+page.markdoc @@ -0,0 +1,78 @@ +--- +layout: post +title: "Announcing OAuth Device Authorization for the Appwrite CLI: Log in from your browser" +description: The Appwrite CLI now signs you in through your browser. Confirm a device code, review permissions, and authorize, without typing credentials into your terminal. +date: 2026-07-29 +cover: /images/blog/announcing-cli-device-authorization/cover.avif +timeToRead: 4 +author: chirag-aggarwal +category: announcement +featured: false +callToAction: true +faqs: + - question: "What is OAuth Device Authorization in the Appwrite CLI?" + answer: "OAuth Device Authorization is the new login flow for the Appwrite CLI, based on the OAuth 2.0 device authorization pattern. Instead of prompting for your credentials in the terminal, the CLI shows a code and a URL. You confirm the code in your browser, review the requested permissions, and authorize the CLI with your Appwrite account." + - question: "Which command starts the new login flow?" + answer: "The same command as before: `appwrite login`. If you use a self-hosted instance, add the `--endpoint` flag with your instance URL. The only thing that changes is what happens after you run it." + - question: "What permissions does the Appwrite CLI request?" + answer: "The authorization screen lists the exact access you grant: viewing your identity and fully managing your Appwrite account on your behalf. You review and approve these permissions in the browser before the CLI can act." + - question: "How do I revoke the CLI's access to my account?" + answer: "You can revoke access anytime from your Appwrite account settings. Once revoked, the CLI can no longer act on your behalf until you authorize it again." + - question: "Does the new login flow affect CI pipelines?" + answer: "No. Non-interactive mode, which authenticates with an API key through `appwrite client`, is unchanged and remains the recommended approach for CI and scripting." +--- + +Signing in to a CLI should not mean typing your account password into a terminal prompt. Your identity already lives in your browser, and that is where authentication should happen. + +Today, we are announcing **OAuth Device Authorization** for the Appwrite CLI. Running `appwrite login` now hands the sign-in process to your browser, so you can authenticate the CLI with the account session you already trust. + +# How it works + +The new flow follows the OAuth 2.0 device authorization pattern. Run `appwrite login`, and the CLI displays a device code and a URL, then waits for approval. + +![The Appwrite CLI displaying a device code and URL](/images/docs/command-line/cli-login-terminal.avif) + +Press Enter to open the URL, or copy it into any browser. Confirm the code on the page matches the one in your terminal and click **Continue**. + +![Confirming the device code in the browser](/images/docs/command-line/dark/cli-login-confirm-code.avif) + +Review the permissions the CLI requests and click **Authorize**. Once approved, the CLI detects the authorization and finishes signing you in. + +![Authorizing the Appwrite CLI in the Console](/images/docs/command-line/dark/cli-login-authorize.avif) + +# Consent you can see + +Before the CLI can act on your behalf, the browser shows you exactly what access you are granting: viewing your identity and fully managing your Appwrite account. + +Authorization is also reversible. You can revoke the CLI's access anytime from your Appwrite account settings. + +# Get started + +Update the Appwrite CLI to the latest version and run: + +```sh +appwrite login +``` + +The [CLI installation guide](/docs/tooling/command-line/installation#login) walks through every step with screenshots. + +{% info title="Seeing an email and password prompt instead?" %} +The CLI either needs an update or is pointed at a self-hosted Appwrite instance, which does not support the OAuth device authorization flow. Run `appwrite update` to get the latest version, or log in with the Appwrite Cloud endpoint explicitly: + +```sh +appwrite login --endpoint="https://cloud.appwrite.io/v1" +``` + +If a self-hosted endpoint persists, delete `prefs.json` from the CLI config directory. On macOS and Linux it lives at `~/.appwrite/prefs.json`, on Windows at `%USERPROFILE%\.appwrite\prefs.json`. +{% /info %} + +{% info title="Existing authentication flows" %} +API key based authentication is not affected by this change. Existing CLI sessions and non-interactive flows that authenticate with an API key through `appwrite client` will continue to work, and API keys remain the recommended way to authenticate the CLI in CI workflows. [Learn more about non-interactive mode](/docs/tooling/command-line/non-interactive) +{% /info %} + +# More resources + +- [Introducing generate command in the Appwrite CLI: Create a type-safe SDK from your schema](/blog/post/appwrite-generate) +- [Announcing the Projects API: Configure your project with Server SDKs](/blog/post/announcing-projects-api) +- [Announcing the Keys API: Create and manage API keys with Server SDKs](/blog/post/announcing-api-keys-api) +- [Join the Appwrite Community on Discord](https://appwrite.io/discord) diff --git a/src/routes/changelog/(entries)/2026-07-29.markdoc b/src/routes/changelog/(entries)/2026-07-29.markdoc new file mode 100644 index 0000000000..402bd9ac67 --- /dev/null +++ b/src/routes/changelog/(entries)/2026-07-29.markdoc @@ -0,0 +1,14 @@ +--- +layout: changelog +title: Browser-based login for the Appwrite CLI +date: 2026-07-29 +cover: /images/blog/announcing-cli-device-authorization/cover.avif +--- + +`appwrite login` now signs you in through your browser using device authorization. The CLI displays a code and a URL, you confirm the code and approve the requested permissions in the browser, and the terminal completes the login automatically. + +Authorization uses your Console session, and you can revoke the CLI's access anytime from your account settings. Update to the latest version of the CLI to get the new flow. Non-interactive mode with API keys for CI is unchanged. + +{% arrow_link href="/blog/post/announcing-cli-device-authorization" %} +Read the announcement +{% /arrow_link %} diff --git a/src/routes/docs/tooling/command-line/installation/+page.markdoc b/src/routes/docs/tooling/command-line/installation/+page.markdoc index 3cb8ff3bfb..beea12f679 100644 --- a/src/routes/docs/tooling/command-line/installation/+page.markdoc +++ b/src/routes/docs/tooling/command-line/installation/+page.markdoc @@ -123,12 +123,58 @@ Before you can use the CLI, you need to login to your Appwrite account using appwrite login ``` -Add the `--endpoint` flag if you're using a self-hosted instance of Appwrite. This flag requires you to add the URL string you're using for your self-hosted instance after the `--endpoint` flag. +Add the `--endpoint` flag if you're using a self-hosted instance of Appwrite. This flag requires you to add the URL string you're using for your self-hosted instance after the `--endpoint` flag. Self-hosted instances do not currently support OAuth-based CLI authentication, so the CLI will prompt for your email and password instead. ```sh appwrite login --endpoint "" ``` -You can log in to multiple accounts or change the **current** account by re-running the command. + +The CLI signs you in through your browser using device authorization. It displays a code and a URL, then waits for approval. + +![Appwrite CLI login in the terminal](/images/docs/command-line/cli-login-terminal.avif) + +Press `Enter` to open the URL in your default browser, or copy the URL and open it manually. In the browser, confirm that the device code matches the code shown in your terminal, then click **Continue**. + +{% only_dark %} +![Confirm your device code](/images/docs/command-line/dark/cli-login-confirm-code.avif) +{% /only_dark %} +{% only_light %} +![Confirm your device code](/images/docs/command-line/cli-login-confirm-code.avif) +{% /only_light %} + +Review the permissions requested by the CLI, then click **Authorize**. + +{% only_dark %} +![Authorize Appwrite CLI](/images/docs/command-line/dark/cli-login-authorize.avif) +{% /only_dark %} +{% only_light %} +![Authorize Appwrite CLI](/images/docs/command-line/cli-login-authorize.avif) +{% /only_light %} + +Once authorized, the browser confirms that your device is connected. Return to your terminal, where the CLI continues automatically and completes the login. + +{% only_dark %} +![Device connected](/images/docs/command-line/dark/cli-login-device-connected.avif) +{% /only_dark %} +{% only_light %} +![Device connected](/images/docs/command-line/cli-login-device-connected.avif) +{% /only_light %} + +You can log in to multiple accounts or change the **current** account by re-running the command. You can revoke the CLI's access anytime in your account settings. + +{% info title="Seeing an email and password prompt instead?" %} +Older CLI versions, and CLI sessions pointed at a self-hosted Appwrite instance, do not support the OAuth device authorization flow and fall back to asking for your email and password. Run `appwrite update` to get the latest version, or pass the Appwrite Cloud endpoint explicitly: + +```sh +appwrite login --endpoint="https://cloud.appwrite.io/v1" +``` + +If the CLI still points at a self-hosted instance, clear the saved preferences by deleting `prefs.json`. On macOS and Linux it lives at `~/.appwrite/prefs.json`, on Windows at `%USERPROFILE%\.appwrite\prefs.json`. +{% /info %} + +{% info title="CI and scripting" %} +The browser-based login flow does not affect API key based authentication. Non-interactive mode with API keys continues to work as before and remains the recommended way to authenticate the CLI in CI workflows. [Learn more about CI mode](/docs/tooling/command-line/non-interactive) +{% /info %} # Initialization {% #initialization %} diff --git a/static/images/blog/announcing-cli-device-authorization/cover.avif b/static/images/blog/announcing-cli-device-authorization/cover.avif new file mode 100644 index 0000000000..808a8631d7 Binary files /dev/null and b/static/images/blog/announcing-cli-device-authorization/cover.avif differ diff --git a/static/images/docs/command-line/cli-login-authorize.avif b/static/images/docs/command-line/cli-login-authorize.avif new file mode 100644 index 0000000000..0151edbe82 Binary files /dev/null and b/static/images/docs/command-line/cli-login-authorize.avif differ diff --git a/static/images/docs/command-line/cli-login-confirm-code.avif b/static/images/docs/command-line/cli-login-confirm-code.avif new file mode 100644 index 0000000000..583d889cf3 Binary files /dev/null and b/static/images/docs/command-line/cli-login-confirm-code.avif differ diff --git a/static/images/docs/command-line/cli-login-device-connected.avif b/static/images/docs/command-line/cli-login-device-connected.avif new file mode 100644 index 0000000000..adca7c4d77 Binary files /dev/null and b/static/images/docs/command-line/cli-login-device-connected.avif differ diff --git a/static/images/docs/command-line/cli-login-terminal.avif b/static/images/docs/command-line/cli-login-terminal.avif new file mode 100644 index 0000000000..edeacec61c Binary files /dev/null and b/static/images/docs/command-line/cli-login-terminal.avif differ diff --git a/static/images/docs/command-line/dark/cli-login-authorize.avif b/static/images/docs/command-line/dark/cli-login-authorize.avif new file mode 100644 index 0000000000..145ea898e1 Binary files /dev/null and b/static/images/docs/command-line/dark/cli-login-authorize.avif differ diff --git a/static/images/docs/command-line/dark/cli-login-confirm-code.avif b/static/images/docs/command-line/dark/cli-login-confirm-code.avif new file mode 100644 index 0000000000..8cafee0923 Binary files /dev/null and b/static/images/docs/command-line/dark/cli-login-confirm-code.avif differ diff --git a/static/images/docs/command-line/dark/cli-login-device-connected.avif b/static/images/docs/command-line/dark/cli-login-device-connected.avif new file mode 100644 index 0000000000..e2481c2baf Binary files /dev/null and b/static/images/docs/command-line/dark/cli-login-device-connected.avif differ