[baptistegh]

Users who sign in to Airflow through SSO or with a second factor have no password to give airflowctl. This adds airflowctl auth login --sso (and auth token --sso), which logs in through the browser when the API server's auth manager offers it through the CLI login discovery route from #75672.

airflowctl only follows the contract documented in core, so it doesn't know or care which auth manager serves it. The Keycloak auth manager is the first to offer browser login, in #75913. The two PRs are independent and can be merged in either order.

related: #75560

Changes

• auth login --sso / auth token --sso read GET /api/v2/auth/cli/metadata. They need authorization_code with S256 and both endpoints, otherwise they fail at once with "does not offer browser login (--sso)". A 404 (an API server without discovery) counts as offering nothing.
• The browser flow is authorization code + PKCE (S256, RFC 7636) over a loopback redirect (RFC 8252): a one-shot HTTP server on 127.0.0.1 with a random port, a random state checked on return, and no request logging, so the code never reaches stderr.
• --no-browser only prints the login URL (for example over ssh -L). It is not the device code flow, which comes in a later PR.
• --timeout (default 300 seconds) bounds the wait for the browser.
• --sso refuses --api-token, --username, --password and --skip-keyring.
• Docs: start.rst describes the new login, and the auth login help image is regenerated.

Not included: refreshing the CLI token with the refresh_token grant, and the device code flow. Both follow in separate PRs.

Trying it

With #75913 and [keycloak_auth_manager] cli_authorization_code_enabled = True:

airflowctl auth login --sso --api-url http://localhost:8080 --env sso
airflowctl dags list --env sso

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

Generated-by: Claude Code (Opus 5.5) following the guidelines

[baptistegh]

Tested end to end in breeze with Keycloak and #75913: auth token --sso and auth login --sso (browser login, loopback callback, then dags list with the stored credentials), the refresh grant, and the error cases (browser login disabled on the server, timeout, incompatible arguments).

[baptistegh]

Pushed a follow-up commit with the review fixes. While in there I also fixed a few things that weren't raised in review:

• Endpoints from the login metadata must now be on the API server's origin. Before, an absolute URL would have received the code, the PKCE verifier and any stored token.
• The code exchange is no longer retried, because codes are single use and a replay can be treated as an attack.
• Error text from the server is escaped, so it can't crash the rich output.
• auth token --sso now refuses --username and --password.