Skip to content

Streamlined OAuth-login handling (forward fixed callback ports) #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oz6un merged 1 commit into from
Aug 11, 2026
Merged

Streamlined OAuth-login handling (forward fixed callback ports) #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,23 @@ and revoke `HCLOUD_TOKEN` from the Hetzner console once you're done provisioning

Optional: enable **Tailscale Serve** on your tailnet for HTTPS preview URLs — nothing here depends on it.

### Logging into other tools later

Some CLIs do browser OAuth by opening a `localhost:<port>` callback that the browser must reach —
which fails on a headless box. Two ways to handle it, easiest first:

- **Prefer a device-code / token flow** when the tool offers one (no forwarding): `gh auth login`,
`codex login --device-auth`, `gcloud auth login --no-launch-browser`, `claude setup-token` (on
your laptop, then export the token on the box).
- **Otherwise forward the callback port.** The two agents' fixed ports (Claude `54545`, Codex `1455`)
are already forwarded by the ssh-config block above, so their logins just work. For any other tool,
add its port to the *live* `ssh devbox` connection with no reconnect:
```sh
ssh -O forward -L 8976:localhost:8976 devbox # 8976 = the port the tool prints
# …do the login, then:
ssh -O cancel -L 8976:localhost:8976 devbox
```

## Daily use

- **`ssh devbox`** lands you in fish inside a persistent tmux session. Detach with `Ctrl-b d`,
Expand Down
10 changes: 10 additions & 0 deletions files/mac-ssh-config.snippet
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,3 +5,13 @@ Host devbox
ControlMaster auto
ControlPath ~/.ssh/cm-%r@%h:%p
ControlPersist 10m
# Browser-OAuth CLI logins on the box redirect to a localhost callback port;
# forwarding that port lets the login complete over the tunnel. The two
# agents use fixed ports, pre-forwarded here so their logins just work:
LocalForward 54545 localhost:54545 # Claude Code OAuth callback
LocalForward 1455 localhost:1455 # Codex OAuth callback
# Any other tool: add its port to the LIVE connection (no reconnect) with
# ssh -O forward -L <port>:localhost:<port> devbox
# and remove it with `ssh -O cancel -L <port>:localhost:<port> devbox`.
# Prefer a device-code / --no-browser / token flow when the tool offers one
# (gh, codex login --device-auth, claude setup-token) — no forwarding needed.
Loading