{
  "slug": "doctl-auth-login-signs-in-through-browser-oauth-297b73ef28e6",
  "title": "doctl auth login signs in through browser OAuth",
  "tools": [
    "doctl"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-13T05:22:43.000Z",
  "announced_at": "2026-10-13T05:22:43.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When authenticating doctl for repository work, run `doctl auth login` to approve browser OAuth, or `doctl auth init` to enter an API token; credentials are stored in an authentication context. Use `--no-browser`, `--timeout`, `--scopes`, `--save-scope`, or `--context <name>` to adjust browser sign-in as needed.",
    "examples": [
      "doctl auth login",
      "doctl auth login --scopes \"read write\"",
      "doctl auth init"
    ],
    "gotchas": [
      "Version: v1.184.0",
      "--no-browser: Print the authorization URL instead of opening a browser.",
      "--timeout: Change how long the authorization link is valid; default is 5 minutes. Documented unit/value format not found.",
      "--scopes: Space-separated permissions requested up front, such as `read write` or `droplet:read account:read`; absent means choose permissions on the authorization screen.",
      "--save-scope: Persist `--scopes` as the default for later sign-ins; combine with `--scopes \"\"` to clear the saved default. No mutual-exclusion rule documented.",
      "--context <name>: Save sign-in credentials to a named context; without it, credentials replace those in `default`, which is selected.",
      "API token (auth init prompt) (required): Enter the DigitalOcean access token generated in the Control Panel when prompted.",
      "Prerequisite: For `doctl auth init`, create an API token in the DigitalOcean Control Panel first.",
      "Prerequisite: Browser OAuth uses DigitalOcean's published doctl application; no app registration is needed.",
      "The authorization link is valid for 5 minutes unless changed with `--timeout`.",
      "Access tokens issued through browser sign-in are short-lived; doctl saves a refresh token and renews automatically when running a command.",
      "Sign in again to change granted scopes or if the session is revoked.",
      "Without `--context`, sign-in replaces credentials in the `default` context and selects it."
    ]
  },
  "why_it_matters": "Authenticate doctl for repository work by signing in through a browser or supplying an API token.",
  "sources": [
    "https://github.com/digitalocean/doctl/releases/tag/v1.184.0",
    "https://github.com/digitalocean/doctl/pull/2012",
    "https://github.com/digitalocean/doctl/blob/v1.184.0/README.md"
  ],
  "rank": 0.96034,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2a-20261017",
    "verdict_id": "wave2a-20261017:wave2a-20261017-64ce7832dc4c446d-0:gate",
    "evidence_hash": "41ac74b745e5882163c1a1acf8b9eae382ef9b837e22fd3568f047826fdecb65"
  },
  "review": {
    "draft_hash": "f05348539a546f1884b911fc4903484636062d1894600744aee0e4372143a4da",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-13T05:22:43.000Z",
    "decision": "wave2a-20261017:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.96 >= 0.9; 2 needed) and Jev gave 0.74 (>= 0.6 needed)."
  }
}