Skip to content

Add a non-interactive device code login - #7220

Draft
maksim-zuev-db wants to merge 3 commits into
device-code-interactive-testsfrom
device-code-agent-login
Draft

Add a non-interactive device code login#7220
maksim-zuev-db wants to merge 3 commits into
device-code-interactive-testsfrom
device-code-agent-login

Conversation

@maksim-zuev-db

@maksim-zuev-db maksim-zuev-db commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Stacked on #7222.

Changes

When stdin is not a terminal, auth login --use-device-code runs in two steps. The first step stores the device code as a pending login in the token store and prints the URL and the user code. Running the same command with the hidden --user-code and --confirmation-code flags exchanges the pending device code and then saves the login like any other. In a terminal, the login stays interactive.

Each profile, or host without a profile, has one pending login, and a new login for it replaces the old one. The second step checks the user code, so completing a replaced login fails with a clear error without sending its confirmation code.

The pending login is a new PendingLogin field of storage.Entry, persisted by the file, keyring, and memory stores. The flow is picked with the new cmdio.IsInputTTY, which, unlike IsPromptSupported, does not depend on stderr, NO_COLOR, TERM=dumb, or Git Bash.

Piped stdin. Before this change, a confirmation code piped into stdin (printf CODE | databricks auth login --use-device-code ...) completed the login. Now any stdin that is not a terminal starts the two-step login, and piped input is ignored. Nobody needs the old pattern in practice: the confirmation code only appears in the browser after the login is started and approved, so it can't be piped in up front. A script would have to keep stdin open and write the code later, and the second step with --confirmation-code covers that case.

Why

An AI agent or a script that runs the login as a one-off command cannot type the confirmation code into a running auth login. The device code never leaves the machine, so a confirmation code that ends up in an agent's transcript cannot complete the login elsewhere.

Tests

Unit tests cover storing a pending login in each store and IsInputTTY. Acceptance tests under device-code/non-interactive cover both steps, flags, errors, and concurrent logins. termtest tests cover the second step run in a terminal, where it must not prompt. The interactive flow is covered by the termtest tests from #7222.

No changelog fragment: --use-device-code is still behind DATABRICKS_CLI_DEVICE_CODE.

This pull request and its description were written by Isaac.

@github-actions

github-actions Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Commit: adfe6a4d8 | Workflow run

Regression test report

Selected 5 changed tests (limit=20, 0 not selected)

5 tests: regression=5 unreleased=0 coverage=0 failing=0

test branch main (35ed095) latest (v1.22.1)
TestAccept/cmd/auth/login/device-code/non-interactive/concurrent ✅ ❌ ❌
TestAccept/cmd/auth/login/device-code/non-interactive/errors ✅ ❌ ❌
TestAccept/cmd/auth/login/device-code/non-interactive/flags ✅ ❌ ❌
TestAccept/cmd/auth/login/device-code/non-interactive/nominal ✅ ❌ ❌
TestAccept/cmd/auth/login/device-code/unsupported-host ✅ ❌ ❌
TestAccept/cmd/auth/login/device-code/non-interactive/concurrent: branch ✅ | main (35ed095) ❌ | latest (v1.22.1) ❌

main (35ed095):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/concurrent/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveconcurrent2616279319/002/output.txt
        @@ -3,58 +3,4 @@
         
         >>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
         
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
        -
        ->>> update_file.py home/.databricks/token-cache.json WDJBMJHT NEWRCODE
        -
        ->>> cache_keys
        -[
        -  "test#device-code"
        -]
        -
        ->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: a newer login for profile test replaced this one. Complete the newer login with its user code. Run the same command without --user-code and --confirmation-code to start a new login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code NEWR-CODE --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> print_requests.py --oneline //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -
        -=== Logins for different targets are independent
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code
        -
        ->>> cache_keys
        -[
        -  "a#device-code",
        -  "b#device-code",
        -  "[DATABRICKS_URL]",
        -  "[DATABRICKS_URL]#device-code",
        -  "test"
        -]
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile b was successfully saved
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile a was successfully saved
        -
        ->>> cache_keys
        -[
        -  "a",
        -  "b",
        -  "[DATABRICKS_URL]",
        -  "test"
        -]
        -
        ->>> print_requests.py --oneline //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-4&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-5&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-3&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        +Exit code: 1
        
    acceptance_test.go:1119: 
        LOG.first: Using a browser on another device, visit:
        LOG.first: http://127.0.0.1:43107/device/verification
        LOG.first: 
        LOG.first: And enter the code:
        LOG.first: WDJB-MJHT
        LOG.first: 
        LOG.first: Once finished, enter the confirmation code provided in your browser.
        LOG.first: Confirmation code: Error: reading confirmation code: EOF

latest (v1.22.1):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/concurrent/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveconcurrent2645513587/002/output.txt
        @@ -3,58 +3,4 @@
         
         >>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
         
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
        -
        ->>> update_file.py home/.databricks/token-cache.json WDJBMJHT NEWRCODE
        -
        ->>> cache_keys
        -[
        -  "test#device-code"
        -]
        -
        ->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: a newer login for profile test replaced this one. Complete the newer login with its user code. Run the same command without --user-code and --confirmation-code to start a new login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code NEWR-CODE --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> print_requests.py --oneline //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -
        -=== Logins for different targets are independent
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code
        -
        ->>> cache_keys
        -[
        -  "a#device-code",
        -  "b#device-code",
        -  "[DATABRICKS_URL]",
        -  "[DATABRICKS_URL]#device-code",
        -  "test"
        -]
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile b was successfully saved
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile a was successfully saved
        -
        ->>> cache_keys
        -[
        -  "a",
        -  "b",
        -  "[DATABRICKS_URL]",
        -  "test"
        -]
        -
        ->>> print_requests.py --oneline //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-4&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-5&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-3&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        +Exit code: 1
        
    acceptance_test.go:1119: 
        LOG.first: Error: unknown flag: --use-device-code
        LOG.first: 
        LOG.first: Usage:
        LOG.first:   databricks auth login [PROFILE] [flags]
        LOG.first: 
        LOG.first: Flags:
        LOG.first:       --client-id string       OAuth client ID to use for U2M authentication
        LOG.first:       --configure-cluster      Prompts to configure cluster
        LOG.first:       --configure-serverless   Prompts to configure serverless
        LOG.first:   -h, --help                   help for login
        LOG.first:       --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        LOG.first:       --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        LOG.first:       --skip-workspace         Skip workspace selection for account-level access
        LOG.first:       --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        LOG.first: 
        LOG.first: Global Flags:
        LOG.first:       --account-id string     Databricks Account ID
        LOG.first:       --debug                 enable debug logging
        LOG.first:       --host string           Databricks Host
        LOG.first:   -o, --output type           output type: text or json (default text)
        LOG.first:   -p, --profile string        ~/.databrickscfg profile
        LOG.first:   -t, --target string         bundle target to use (if applicable)
        LOG.first:       --workspace-id string   Databricks Workspace ID
TestAccept/cmd/auth/login/device-code/non-interactive/errors: branch ✅ | main (35ed095) ❌ | latest (v1.22.1) ❌

main (35ed095):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/errors/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveerrors772709839/002/output.txt
        @@ -5,86 +5,264 @@
         Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Flags the non-interactive login cannot honor
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --configure-cluster
        -Error: --configure-cluster is not supported by the non-interactive device code login. Set cluster_id on the profile after the login
        +Using a browser on another device, visit:
        +[DATABRICKS_URL]/device/verification
         
        +And enter the code:
        +WDJB-MJHT
        +
        +Once finished, enter the confirmation code provided in your browser.
        +Confirmation code: Error: reading confirmation code: EOF
        +
         === Missing host
         
         >>> musterr [CLI] auth login --use-device-code
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: the command is being run in a non-interactive environment, please specify a host using --host
         
         >>> musterr [CLI] auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Incomplete flags of the second step
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --confirmation-code FTFA-QQKY
        -Error: --confirmation-code requires --user-code
        +Error: unknown flag: --confirmation-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT
        -Error: --user-code requires --confirmation-code
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: --confirmation-code requires --use-device-code
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Account host
         
         >>> musterr [CLI] auth login --host https://accounts.cloud.databricks.test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Warn: [hostmetadata] failed to fetch host metadata for https://accounts.cloud.databricks.test, will skip for 1m0s
        -Error: --use-device-code is only supported for workspace hosts
        +Error: unknown flag: --user-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Profile scoped to resources
         
         >>> musterr [CLI] auth login --profile resources --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: --use-device-code cannot be used with profile resources because its login is scoped to resources. Log in without --use-device-code
        +Error: unknown flag: --user-code
         
        -=== No pending login
        +Usage:
... (120 more lines truncated, raise DATABRICKS_CLI_TEST_MAX_LOG to see more)

latest (v1.22.1):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/errors/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveerrors1575178910/002/output.txt
        @@ -2,89 +2,329 @@
         === Device code login is disabled by default
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
        -Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Flags the non-interactive login cannot honor
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --configure-cluster
        -Error: --configure-cluster is not supported by the non-interactive device code login. Set cluster_id on the profile after the login
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Missing host
         
         >>> musterr [CLI] auth login --use-device-code
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Incomplete flags of the second step
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --confirmation-code FTFA-QQKY
        -Error: --confirmation-code requires --user-code
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT
        -Error: --user-code requires --confirmation-code
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
... (201 more lines truncated, raise DATABRICKS_CLI_TEST_MAX_LOG to see more)
TestAccept/cmd/auth/login/device-code/non-interactive/flags: branch ✅ | main (35ed095) ❌ | latest (v1.22.1) ❌

main (35ed095):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/flags/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveflags2893691513/002/output.txt
        @@ -8,29 +8,7 @@
         And enter the code:
         WDJB-MJHT
         
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        +Once finished, enter the confirmation code provided in your browser.
        +Confirmation code: Error: reading confirmation code: EOF
         
        ->>> [CLI] auth login --profile scoped --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile scoped was successfully saved
        -
        ->>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+sql"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -
        -=== Serverless compute is configured in the second step
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile serverless --use-device-code --configure-serverless
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-MJHT
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile serverless --use-device-code --configure-serverless --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile serverless was successfully saved
        +Exit code: 1
        
    acceptance_test.go:1312: Missing output file: out.databrickscfg

latest (v1.22.1):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/flags/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactiveflags1531064383/002/output.txt
        @@ -2,35 +2,29 @@
         === Scopes and client ID from the profile
         
         >>> [CLI] auth login --profile scoped --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        +Error: unknown flag: --use-device-code
         
        -And enter the code:
        -WDJB-MJHT
        +Usage:
        +  databricks auth login [PROFILE] [flags]
         
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
         
        ->>> [CLI] auth login --profile scoped --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile scoped was successfully saved
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
         
        ->>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+sql"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
         
        -=== Serverless compute is configured in the second step
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile serverless --use-device-code --configure-serverless
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-MJHT
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile serverless --use-device-code --configure-serverless --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile serverless was successfully saved
        +Exit code: 1
        
    acceptance_test.go:1312: Missing output file: out.databrickscfg
TestAccept/cmd/auth/login/device-code/non-interactive/nominal: branch ✅ | main (35ed095) ❌ | latest (v1.22.1) ❌

main (35ed095):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/nominal/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactivenominal1308921762/002/output.txt
        @@ -8,86 +8,7 @@
         And enter the code:
         WDJB-MJHT
         
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        +Once finished, enter the confirmation code provided in your browser.
        +Confirmation code: Error: reading confirmation code: EOF
         
        -=== The first step stores the device code and saves no profile
        -
        ->>> find.py home
        -home/.databricks/token-cache.json
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]#device-code"
        -]
        -
        -=== Confirm the login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -
        ->>> [CLI] auth token --host [DATABRICKS_URL]
        -json.access_token = "oauth-token";
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]"
        -]
        -
        -=== Start the login with a profile
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-MJHT
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        -=== Confirm the login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> [CLI] auth token --profile test
        -json.access_token = "oauth-token";
        -
        ->>> [CLI] auth profiles
        -Name            Host                    Valid
        -test (Default)  [DATABRICKS_URL]  YES
        -
        -=== Start the login again with the host from the saved profile
        -
        ->>> [CLI] auth login --profile test --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-MJHT
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        ->>> [CLI] auth token --profile test
        -json.access_token = "oauth-token";
        -
        ->>> [CLI] auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]",
        -  "test"
        -]
        -
        ->>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-3&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        +Exit code: 1
        
    acceptance_test.go:1312: Missing output file: out.databrickscfg

latest (v1.22.1):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/non-interactive/nominal/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codenon-interactivenominal3824754149/002/output.txt
        @@ -2,92 +2,29 @@
         === Start the login without a profile
         
         >>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        +Error: unknown flag: --use-device-code
         
        -And enter the code:
        -WDJB-MJHT
        +Usage:
        +  databricks auth login [PROFILE] [flags]
         
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
         
        -=== The first step stores the device code and saves no profile
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
         
        ->>> find.py home
        -home/.databricks/token-cache.json
         
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]#device-code"
        -]
        -
        -=== Confirm the login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -
        ->>> [CLI] auth token --host [DATABRICKS_URL]
        -json.access_token = "oauth-token";
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]"
        -]
        -
        -=== Start the login with a profile
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-MJHT
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        -=== Confirm the login
        -
        ->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> [CLI] auth token --profile test
        -json.access_token = "oauth-token";
        -
        ->>> [CLI] auth profiles
        -Name            Host                    Valid
        -test (Default)  [DATABRICKS_URL]  YES
        -
        -=== Start the login again with the host from the saved profile
        -
        ->>> [CLI] auth login --profile test --use-device-code
        -Using a browser on another device, visit:
        -[DATABRICKS_URL]/device/verification
        -
        -And enter the code:
        -WDJB-MJHT
        -
        -Once finished, complete the login by running the same command with
        ---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
        -provided in your browser.
        -
        ->>> [CLI] auth token --profile test
        -json.access_token = "oauth-token";
        -
        ->>> [CLI] auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
        -Profile test was successfully saved
        -
        ->>> cache_keys
        -[
        -  "[DATABRICKS_URL]",
        -  "test"
        -]
        -
        ->>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        -{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
        -{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-3&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
        +Exit code: 1
        
    acceptance_test.go:1312: Missing output file: out.databrickscfg
TestAccept/cmd/auth/login/device-code/unsupported-host: branch ✅ | main (35ed095) ❌ | latest (v1.22.1) ❌

main (35ed095):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/unsupported-host/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codeunsupported-host267504475/002/output.txt
        @@ -2,7 +2,7 @@
         === No host
         
         >>> musterr [CLI] auth login --profile new-profile --use-device-code
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: the command is being run in a non-interactive environment, please specify a host using --host
         
         === Account host

latest (v1.22.1):

acceptance_test.go:1341: Diff:
        --- cmd/auth/login/device-code/unsupported-host/output.txt
        +++ /tmp/TestAcceptcmdauthlogindevice-codeunsupported-host4257243435/002/output.txt
        @@ -2,30 +2,170 @@
         === No host
         
         >>> musterr [CLI] auth login --profile new-profile --use-device-code
        -Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Account host
         
         >>> musterr [CLI] auth login --host https://accounts.cloud.databricks.test --profile test --use-device-code
        -Warn: [hostmetadata] failed to fetch host metadata for https://accounts.cloud.databricks.test, will skip for 1m0s
        -Error: --use-device-code is only supported for workspace hosts
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --profile account --use-device-code
        -Error: --use-device-code is only supported for workspace hosts
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Unified host
         
         >>> DATABRICKS_DISCOVERY_URL=[DATABRICKS_URL]/oidc/accounts/spog-acct-123/.well-known/oauth-authorization-server musterr [CLI] auth login --host [DATABRICKS_URL] --use-device-code
        -Error: --use-device-code is only supported for workspace hosts
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Workspace without device code login
         
         >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
        -Error: device code login is not enabled for this workspace
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         >>> musterr [CLI] auth login --profile workspace --use-device-code
        -Error: device code login is not enabled for this workspace
        +Error: unknown flag: --use-device-code
         
        +Usage:
        +  databricks auth login [PROFILE] [flags]
        +
        +Flags:
        +      --client-id string       OAuth client ID to use for U2M authentication
        +      --configure-cluster      Prompts to configure cluster
        +      --configure-serverless   Prompts to configure serverless
        +  -h, --help                   help for login
        +      --resource stringArray   RFC 8707 resource indicator to scope the login to (repeatable). Requires --host.
        +      --scopes string          Comma-separated list of OAuth scopes to request (defaults to 'all-apis')
        +      --skip-workspace         Skip workspace selection for account-level access
        +      --timeout duration       Timeout for completing login challenge in the browser (default 1h0m0s)
        +
        +Global Flags:
        +      --account-id string     Databricks Account ID
        +      --debug                 enable debug logging
        +      --host string           Databricks Host
        +  -o, --output type           output type: text or json (default text)
        +  -p, --profile string        ~/.databrickscfg profile
        +  -t, --target string         bundle target to use (if applicable)
        +      --workspace-id string   Databricks Workspace ID
        +
        +
         === Device authorization requests
         
         >>> print_requests.py //oidc/v1/device/auth
        +File [OUTPUT_DIR]/out.requests.txt not found
        +
        +Exit code: 1

@eng-dev-ecosystem-bot

eng-dev-ecosystem-bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Integration test report

Commit: adfe6a4

Run: 40719029521

Env ✅​pass 🙈​skip Time
✅​ aws linux-2core-8gb 281 20 5:05
✅​ aws-windows-latest-4core-16gb 283 18 3:51
✅​ azure linux-2core-8gb 280 20 5:18
✅​ azure-windows-latest-4core-16gb 282 18 4:13
✅​ gcp linux-2core-8gb 281 20 5:07
✅​ gcp-windows-latest-4core-16gb 283 18 3:59
Top 6 slowest tests (at least 2 minutes):
duration env testname
4:09 azure-windows-latest-4core-16gb TestAccept
3:53 gcp-windows-latest-4core-16gb TestAccept
3:44 aws-windows-latest-4core-16gb TestAccept
3:35 aws linux-2core-8gb TestAccept
3:33 azure linux-2core-8gb TestAccept
3:24 gcp linux-2core-8gb TestAccept

@maksim-zuev-db
maksim-zuev-db force-pushed the device-code-agent-login branch from 4ff0b1e to 1b2be13 Compare October 28, 2026 14:05
@maksim-zuev-db maksim-zuev-db mentioned this pull request Oct 28, 2026
Open
@maksim-zuev-db
maksim-zuev-db changed the base branch from device-code-split-steps to device-code-interactive-tests October 28, 2026 14:06
@maksim-zuev-db maksim-zuev-db mentioned this pull request Oct 28, 2026
Open
@maksim-zuev-db
maksim-zuev-db force-pushed the device-code-agent-login branch from 1b2be13 to 26349d5 Compare October 28, 2026 14:35
@maksim-zuev-db
maksim-zuev-db force-pushed the device-code-agent-login branch from 26349d5 to 90d5979 Compare October 28, 2026 14:45
maksim-zuev-db and others added 3 commits October 28, 2026 15:18
@maksim-zuev-db Isaac
Add cmdio.IsInputTTY
04c70cd 
IsPromptSupported tells whether the CLI can render a prompt, so it also
depends on stderr, NO_COLOR, TERM=dumb and Git Bash. A command that reads a
plain line from stdin only needs to know whether a user can type into it.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Store pending device code logins in the token store
dec6c3b 
A non-interactive device code login is completed by a later CLI invocation.
Entry gets a PendingLogin field that holds the device code and the user code
until then, so that the device code stays in the user's token storage instead
of being printed or passed on the command line. A pending entry has no token.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db Isaac
Add a non-interactive device code login
adfe6a4 
Device code login reads the confirmation code from stdin, which only works
when someone can type into the command. An AI agent or a script that runs
the login as a one-off command cannot. When stdin is not a terminal, auth
login --use-device-code requests the device authorization, stores the device
code as a pending login in the token store, and prints the URL and the user
code. Running the same command with the hidden --user-code and
--confirmation-code flags exchanges the pending device code and then saves
the login like any other.

The device code never leaves the machine, so a confirmation code that ends
up somewhere else, such as an agent's transcript, cannot complete the login
elsewhere. The pending login is keyed by the login's cache key with a
#device-code suffix, so the current token keeps working until the login
completes. A new login for the same target replaces it, and the user code
tells a replaced login apart without sending its confirmation code to the
server.

Co-authored-by: Isaac <no-reply@databricks.com>
@maksim-zuev-db maksim-zuev-db mentioned this pull request Oct 28, 2026
Closed
@maksim-zuev-db
maksim-zuev-db force-pushed the device-code-agent-login branch from cf4b0e9 to adfe6a4 Compare October 28, 2026 15:42
@maksim-zuev-db maksim-zuev-db mentioned this pull request Oct 28, 2026
Open
@maksim-zuev-db
maksim-zuev-db removed this pull request from stack #7223 October 28, 2026 15:48
@maksim-zuev-db
maksim-zuev-db changed the base branch from device-code-interactive-tests to device-code-pending-login-storage October 28, 2026 15:48
@maksim-zuev-db
maksim-zuev-db removed this pull request from stack #7236 October 28, 2026 15:57
@maksim-zuev-db
maksim-zuev-db changed the base branch from device-code-pending-login-storage to device-code-interactive-tests October 28, 2026 15:57
@maksim-zuev-db
maksim-zuev-db requested review from simonfaltum and removed request for simonfaltum October 28, 2026 16:03

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@maksim-zuev-db @eng-dev-ecosystem-bot