Authentication

Kiro supports several authentication providers across all surfaces:

The providers work the same way everywhere, and sign-in completes in the browser:

• GitHub, Google, and AWS Builder ID — choose the provider, authenticate in your browser, and authorize the Kiro app (on GitHub, the app to authorize appears as kirodotdev).
• AWS IAM Identity Center — you'll need the Start URL and the AWS Region that hosts your identity directory, provided by your admin or help desk.
• External identity provider — choose Your organization, enter your work email to find your organization, then complete sign-in with your organization's identity provider. This is also the path for AWS GovCloud (US) regions.

How you launch the flow differs per surface:

When running Kiro CLI on a remote machine (via SSH, SSM, containers, etc.), authentication works differently since the remote machine cannot open a browser.

Builder ID, IAM Identity Center, Google, and GitHub support device flow authentication in remote environments. The CLI displays a URL and a one-time code that you enter in any browser - no port forwarding required.

1. Run kiro-cli login and select your sign-in method (for example, Use with Builder ID, Use with Google, Use with GitHub, or Use with Your Organization).
2. The CLI displays a URL and a one-time code.
3. Open the URL in any browser (on your local machine, phone, or another device).
4. Enter the code and complete authentication.
5. The CLI detects the successful login automatically.

For CI/CD pipelines and automation scripts, you can authenticate using an API key instead of interactive sign-in.

1. Sign in to app.kiro.dev with your Kiro Pro, Pro+, Pro Max, or Power account.
2. Navigate to the API Keys section.
3. Create a new API key and copy it. The full key value is only shown at creation time. Set a meaningful name to remember the context of the key.

Set the KIRO_API_KEY environment variable and run Kiro CLI in non-interactive mode:

export KIRO_API_KEY=ksk_xxxxxxxx
kiro-cli chat --no-interactive "your prompt here"

On Windows:

$env:KIRO_API_KEY = "ksk_xxxxxxxx"
kiro-cli chat --no-interactive "your prompt here"

API key authentication supports all Kiro CLI features available in non-interactive mode. For interactive sessions, use browser-based sign-in instead. For CI/CD pipelines, automation scripts, and detailed headless usage, see Headless mode.

When multiple credentials are available, Kiro CLI uses this precedence order:

1. Active browser session (from kiro-cli login)
2. KIRO_API_KEY environment variable
3. No credentials - CLI prompts you to sign in

To check which authentication method is active, run kiro-cli whoami. Credits consumed using the API key are decremented from your subscription credits.

Connect your GitHub account to give the agent access to your repositories:

1. Go to Settings and select the Agent tab.
2. Under GitHub, click Connect GitHub.
3. Authorize the Kiro Agent GitHub app.
4. Select which repositories the agent can access.

You must have write permissions on repositories for the agent to create branches and open pull requests.

How repository access works: Kiro Web shows all repositories where both conditions are met:

1. Your GitHub user has access to the repository.
2. The Kiro Agent GitHub app has been installed and authorized for that repository.

This means you see repositories from personal accounts, shared repositories, and organizations - as long as both your GitHub user and the Kiro Agent app have access.

See the GitHub integration guide for detailed setup instructions.

To use Kiro with AWS GovCloud (US):

• Ensure the Start URL used during authentication contains "us-gov-home", for example: https://start.us-gov-home.awsapps.com/directory/d-XXXXXXXXXX
• Kiro uses the same download/installer for both commercial and AWS GovCloud (US) regions. IAM Identity Center authentication automatically routes traffic to the appropriate AWS GovCloud (US) region.
• Kiro IDE version 0.9.2+ and Kiro CLI version 1.25.0+ are required for AWS GovCloud (US) regions support.

If you encounter problems during the authentication process, such as browser redirect failures or sign-in errors, check the troubleshooting guide for platform-specific solutions and common fixes.

• Set up your first project
• Explore privacy and data protection
• Configure enterprise identity providers