Log in to Grok Build with device code

On SSH hosts, containers, and other machines without a usable browser, use device-code login. Official: CLI Reference (grok login --device-auth) and Enterprise Deployments.

Steps

1. On the remote machine, run:

grok login --device-auth

2. Grok prints a URL and a short user code (RFC 8628 device authorization).
3. Open that URL on any device that has a browser (your laptop or phone).
4. Enter the user code and finish the sign-in.
5. Back on the remote machine, the CLI caches the session and you can run grok.

Device-code sessions are refreshable, same as browser OIDC. API keys (XAI_API_KEY) are the other headless path; they do not refresh — see Set Grok Build environment variables and Run Grok Build CLI headless.

When to pick another method

Method	Trigger	Best for
Browser OIDC	grok login	Local terminal with a browser
Device code	grok login --device-auth	SSH, containers, cloud devboxes
API key	XAI_API_KEY or model.api_key	CI/CD scripts
External auth provider	auth_provider_command	Corporate IdP / token broker

Enterprise admins can pin login with disable_api_key_auth and force_login_team_uuid in requirements.toml. Run grok inspect to see which login policy loaded. Full managed rollout: Deploy Grok Build for enterprise.

Pitfalls

• The machine still needs outbound HTTPS to auth.x.ai and cli-chat-proxy.grok.com.
• Completing the code on a browser does nothing if the CLI process exited before the grant finished — leave the grok login --device-auth process running until it confirms success.
• grok logout clears cached credentials when you need a clean re-login.