OAuth support?

[rcdailey]

The official Linear MCP supports oauth, and I'm wondering if you could make the CLI do the same. Having to explicitly create and manage API keys is insecure and cumbersome.

[schpet]

agree this would be good to support. it would desirable for me for it to work when you're ssh'd into a VM (sometimes this requires a device code or something)

[rmax]

As a workaround, when you get the oauth redirect you can grab the callback url and run curl in the remote host so that the remote process gets the token

Not ideal but device code will require third-party system support

[zhendalf]

Thanks for raising this. We shared the concern about asking people and agents to create and manage long-lived personal API keys, and implemented browser OAuth in linear-sdk-cli.

Disclosure: I maintain that project. The released flow uses Authorization Code with PKCE for a human actor=user, validates the viewer and workspace, stores the session only in the OS keyring, refreshes rotating tokens, and revokes the grant on logout:

bun add --global linear-sdk-cli
lin auth login
lin auth status

There is also lin auth login --no-browser, but I want to be precise about the SSH limitation discussed above: it still requires the machine running the CLI to receive the loopback callback. Linear does not currently document a device-code flow, so this does not solve the fully headless/device-code case. Hosted apps and agents can instead inject an OAuth access token through LINEAR_ACCESS_TOKEN without asking the CLI to persist it.

Sharing this as an available option rather than a criticism of this project; schpet's human-first and git-aware design remains an important influence on ours.