Wrangler login now supports Device Authorization Grant
wrangler login now supports OAuth 2.0 Device Authorization Grant via the --device flag, allowing authentication without a local callback server. This eliminates the need for port forwarding or manual callback handling in containers, SSH sessions, and other restricted environments.
wrangler login now supports the OAuth 2.0 Device Authorization Grant ↗. Pass --device to authenticate without starting a temporary callback server on localhost:8976:
npx wrangler login --deviceWrangler prints a verification URL and a short user code, opens the URL in your default browser with the code already filled in, and polls Cloudflare for an access token while you approve the request:
⛅️ wrangler 4.119.0
────────────────────
Attempting to login via OAuth Device Authorization Grant...
To authorize Wrangler, please visit:
https://dash.cloudflare.com/oauth2/device
and enter the code:
WDJB-MJHT
You have 5 minutes to approve this request.
Opening a link in your default browser: https://dash.cloudflare.com/oauth2/device?user_code=WDJB-MJHT
Successfully logged in.The default login flow needs your browser to reach localhost:8976, which is not always possible from containers, remote SSH sessions, or GitHub Codespaces. Previously these environments required forwarding ports or fetching the callback URL with curl from a second terminal session. Because --device has no callback server, those workarounds are no longer necessary.
Since the plain verification URL and user code are both printed to the terminal, you can also approve the request from a phone or another machine. Pass --browser=false to stop Wrangler from opening a browser at all.
Available in Wrangler version 4.119.0 or later. For more information, refer to wrangler login.
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
Cloudflare API MCP server now serves Cloudflare skills
The Cloudflare API MCP server now integrates with the Skills over MCP extension, allowing MCP clients to discover and access Cloudflare skills. Users can add the MCP server endpoint to compatible MCP clients to access these skills.
WAF failed detections field now available in Rules
A new cf.appsec.request.failed_detections field lets you control how rules handle requests when security detections fail. This array of detection IDs covers content scanning, WAF attack scoring, attack signatures, leaked credentials, and AI-based PII/prompt injection/custom topic detection failures, and works across custom rules, rate limiting rules, and request header transform rules.
Markdown for Agents: More efficient in-process streaming conversion
Markdown for Agents now uses an in-process streaming engine at the edge to convert HTML, reducing overhead and memory use. The conversion limit increased from 2 MiB to 6 MiB, and token count headers are no longer generated.