wrangler login supports device authorization

Introduced 2026-08-05 · score 0.98

HOW TO USE IT

When the browser cannot reach Wrangler’s local `localhost:8976` callback, run `wrangler login --device` and approve the request using the printed verification URL and user code.

WHY THIS HELPS

Authenticate Wrangler from a container, remote SSH session, or Codespace where the browser cannot reach `localhost:8976`.

BEFORE THIS CHANGE

The default login flow uses a local callback server at `localhost:8976`; the browser must be able to reach it. In containers, the docs describe mapping port 8976 and setting `--callback-host=0.0.0.0` as a workaround.

REQUIREMENTS AND LIMITATIONS

• Version: 4.119.0
• --device: Defaults to `false`; uses OAuth 2.0 Device Authorization Grant instead of the default `localhost` callback flow.
• --browser: Boolean; defaults to `true`. Automatically opens the OAuth link. Set `--browser=false` to suppress opening it.
• --callback-host: Defaults to `localhost`; sets the callback listener host. Cannot be combined with `--device`.
• --callback-port: Defaults to `8976`; sets the callback listener port. Cannot be combined with `--device`.
• Device authorization polls the token endpoint until approval, with a 5-minute hard cap.
• The verification URL is rejected unless it is an `https` URL on the same auth domain the device code was requested from; an invalid URL is neither printed nor opened.
• `--callback-host` and `--callback-port` cannot be combined with `--device`, because this flow does not start a local callback server.

FIRST-PARTY EVIDENCE

• https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.119.0
• https://developers.cloudflare.com/workers/wrangler/commands/general/

Check the installed version and the source before using it. Entry JSON

Report a problem with this card