Skip to main content

One post tagged with "GitHub"

View All Tags

Your remote AI agent needs auth? A Device Flow protocol deep-dive

· 10 min read
Booker Zhao
AI Full-Stack Engineer / CloudBase AI ToolKit Author

I was setting up GitHub CLI on a TencentOS server recently — an AI agent was running on it, and I needed to talk to it via phone IM. Classic authentication puzzle:

  • No browser (remote server, no GUI)
  • No sudo (can only install to my ~/bin)
  • Needed gh to authenticate and create PRs
  • Critical: couldn't send a Token through the IM chat (IM servers, chat history, agent context — every layer sees it)

Traditional OAuth requires browser redirects. Not an option here.

First instinct: generate a Personal Access Token manually, pipe it in with gh auth login --with-token. It works, but it's painful — open GitHub settings, find the token page, select permissions, copy, paste in terminal. Months later when the token expires, repeat everything.

I dug through GitHub CLI's docs and found it uses a different path by default: Device Flow (device authorization grant). Running gh auth login --web prints a verification code. You open github.com/login/device on another device, enter the code, and the terminal auto-completes auth.

The whole process takes under two minutes. I thought — this is clever. Worth taking apart to see how it works under the hood.