Authentication methods

Kiro supports the following authentication providers:

• GitHub: Seamless integration with your GitHub account
• Google: Sign in with your Google credentials
• AWS Builder ID: Quick setup for individual developers
• AWS IAM Identity Center: Enterprise-grade authentication
• External identity provider: Connect through your organization's identity provider such as Microsoft Entra ID or Okta

1. At the command line, enter kiro-cli or kiro-cli login. You'll be prompted to press Enter to complete sign-in in your browser.
2. In your browser, choose the organization or system through which you will authenticate:
   • Google
   • GitHub
   • Builder ID
   • Your organization — including AWS GovCloud (US)
3. After you authenticate, you'll receive a message in your browser, directing you back to your terminal.
4. When you return to your terminal, you should be signed in with the Kiro CLI.

When running Kiro CLI on a remote machine (via SSH, SSM, containers, etc.), authentication works differently since the remote machine cannot open a browser.

Builder ID, IAM Identity Center, Google, and GitHub support device flow authentication in remote environments. The CLI displays a URL and a one-time code that you enter in any browser, no port forwarding required.

1. Run kiro-cli login and select your sign-in method (for example, Use with Builder ID, Use with Google, Use with GitHub, or Use with Your Organization)
2. The CLI displays a URL and a one-time code
3. Open the URL in any browser (on your local machine, phone, or another device)
4. Enter the code and complete authentication
5. The CLI detects the successful login automatically

No port forwarding or tunnel setup required.

For CI/CD pipelines and automation scripts, you can authenticate using an API key instead of interactive sign-in.

1. Sign in to app.kiro.dev with your Kiro Pro, Pro+, or Power account.
2. Navigate to the API Keys section.
3. Create a new API key and copy it. The full key value is only shown at creation time. Set a meaningful name to remember the context of the key.

Set the KIRO_API_KEY environment variable and run Kiro CLI in non-interactive mode:

export KIRO_API_KEY=ksk_xxxxxxxx
kiro-cli chat --no-interactive "your prompt here"

On Windows:

$env:KIRO_API_KEY = "ksk_xxxxxxxx"
kiro-cli chat --no-interactive "your prompt here"

API key authentication supports all Kiro CLI features available in non-interactive mode. For interactive sessions, use browser-based sign-in instead.

For CI/CD pipelines, automation scripts, and detailed headless usage, see Headless mode.

When multiple credentials are available, Kiro CLI uses this precedence order:

1. Active browser session (from kiro-cli login)
2. KIRO_API_KEY environment variable
3. No credentials — CLI prompts you to sign in

To check which authentication method is active, run kiro-cli whoami.

Credits consumed using the API key are decremented from your subscription credits.

To sign out of Kiro CLI

1. At the command line, enter kiro-cli logout.

If you encounter problems during the authentication process, such as browser redirect failures or sign-in errors, check our troubleshooting guide for platform-specific solutions and common fixes.

• Review FAQ
• Explore Chat features
• Get started with Kiro CLI