Sign in to CLIs on your server, from your phone.
Logins like codex login open a browser and wait on localhost. On a remote machine there is no browser. localauth runs the login, shows its sign-in link on your phone, and hands the last page back to the waiting command. Tokens are created on the server and login data is encrypted at rest by default. Add a passkey to turn on end-to-end encryption.
# on the server, once: connect it to your account npm install -g localauth localauth login # then wrap any login that wants a browser localauth run -- codex login
Step 1
Run the login
Prefix it with localauth run --. localauth catches the sign-in link the command opens or prints, and streams its output.
Step 2
Sign in on your phone
Open localauth.dev and tap the link. Sign in to the service as usual. The browser ends on a localhost page that won't load.
Step 3
Hand it back
Tap Paste and finish. The address goes to your server, which checks it and passes it to the command. The login completes there.
What localauth.dev can see
Encrypted at rest by default
Any browser signed in to your account can read your logins. The service encrypts stored data with a secret held outside the database. In this mode it can read pasted callbacks too, including API keys some tools put there, such as Framer.
End-to-end with a passkey
Add a PRF-capable passkey on the Account page to turn on end-to-end encryption. Your passkey unlocks your account key on synced devices; keys never travel in links. A passkey without PRF can still sign in.
Checked on your machine
Only a localhost address on the port the command is waiting on, with the matching OAuth state, is passed on. Nothing you paste can reach anything else.
The service still sees that a login happened, when, and whether it finished. The page's code comes from localauth.dev, like any web app. End-to-end encryption cannot protect against a compromised site serving altered code.
Works with logins that wait on localhost
codex loginclaude mcp logingcloud auth loginagent loginkargo login --ssowrangler loginvercel logingh auth login
Device-code logins show up too; there is just nothing to paste. An agent skill teaches Claude Code and Codex to use localauth whenever a login needs a browser.
Run your own
localauth deploys to Cloudflare Workers with D1. Put it behind Cloudflare Access and it uses Access's sign-in instead of its own accounts. Self-hosting guide