Add device flow authentication by carole-lavillonniere · Pull Request #18 · localstack/lstk

carole-lavillonniere · 2026-02-05T20:33:35Z

This PR adds a device code flow as a fallback option when the browser-based authentication doesn't work.

When running lstk start, the CLI now supports two authentication paths:

Browser Flow (primary, introduced here Browser authentication flow #9): Opens browser and listens for callback on localhost:45678
Device Flow (fallback, new in this PR): User presses ENTER to manually complete authentication using a verification code

User Experience

When running lstk:

Browser didn't open? Open https://app.localstack.cloud/auth/request/abc123 to authorize device.
Verification code: XYZ789
Waiting for authentication... (Press ENTER when complete)

If user presses ENTER after confirming in browser:

Checking if auth request is confirmed...
Auth request confirmed, exchanging for token...
Fetching license token...
Login successful!

Mock Server Approach

This PR introduces a platform API client.
The device flow tests use httptest.NewServer to create a real HTTP server that mimics the platform API.
The production code remains unchanged, we just point it to a different URL via LOCALSTACK_PLATFORM_URL.
This allows TestDeviceFlowSuccess to verify the complete end-to-end flow including container startup with a valid token.

carole-lavillonniere · 2026-02-05T20:37:05Z

internal/auth/login.go

-		if err := listener.Close(); err != nil {
-			log.Printf("failed to close listener: %v", err)
-		}
-	}()


server.Shutdown() closes the listener, so no explicit close needed

carole-lavillonniere · 2026-02-06T09:21:10Z

internal/auth/login.go

-func getWebAppURL() string {
-	// allows overriding the URL for testing
-	if url := os.Getenv("LOCALSTACK_WEB_APP_URL"); url != "" {
-		return url


Not sure why I added this in the first place, but we never overwrite it at the moment, so I removed it.

Theoretically we could use it to test against staging or locally started webapp.

I wonder though if we should maybe look into handling these envvars with the config package? I'll refactor it slightly later maybe

👍 Makes sense. Put it back in.
I agree it would be good to have a central place to read env vars and not do it all over the codebase.
I used this in the past https://github.com/caarlos0/env

carole-lavillonniere · 2026-02-06T10:53:18Z

test/integration/start_test.go

 	assert.True(t, inspect.State.Running, "container should be running")
 }

-func TestStartCommandTriggersLoginWithoutToken(t *testing.T) {


This test was just moved to test/integration/login_browser_flow_test.go

silv-io

Just some minor nits and questions :) But looks nice ✅

silv-io · 2026-02-09T12:27:54Z

internal/api/client.go

+}
+
+func NewPlatformClient() *PlatformClient {
+	baseURL := os.Getenv("LOCALSTACK_PLATFORM_URL")


nit: We already have this in the original CLI as API_ENDPOINT (which is set to https://api.localstack.cloud/v1). Maybe we can keep this with that name here for consistency?

Makes sense! Renamed to LOCALSTACK_API_ENDPOINT

silv-io · 2026-02-09T12:29:50Z

internal/auth/login.go


-func (browserLogin) Login(ctx context.Context) (string, error) {
+func startCallbackServer() (*http.Server, chan string, chan error, error) {
 	listener, err := net.Listen("tcp", "127.0.0.1:45678")


nit: I know it was in already before, but maybe we can have this address defined as a constant somewhere?

👍 Added a constant

silv-io · 2026-02-09T13:07:53Z

internal/auth/login.go

+	// Listen for ENTER key in background
+	go func() {
+		reader := bufio.NewReader(os.Stdin)
+		_, _ = reader.ReadString('\n')
+		enterCh <- struct{}{}
+	}()


note: here we'll have to check as well how to integrate it well with UI components

silv-io · 2026-02-09T13:09:30Z

internal/auth/login.go

-func getWebAppURL() string {
-	// allows overriding the URL for testing
-	if url := os.Getenv("LOCALSTACK_WEB_APP_URL"); url != "" {
-		return url


Theoretically we could use it to test against staging or locally started webapp.

I wonder though if we should maybe look into handling these envvars with the config package? I'll refactor it slightly later maybe

silv-io · 2026-02-09T13:11:41Z

test/integration/login_browser_flow_test.go

+	time.Sleep(1 * time.Second)
+
+	// Simulate browser callback with mock token
+	resp, err := http.Get("http://127.0.0.1:45678/auth/success?token=mock-token")


q: what happens if we use https://localhost.localstack.cloud instead of http://127.0.0.1:45678? could we still handle it then? I imagine in the browser we'd prefer to send to https

The callback is local (browser → 127.0.0.1) and never goes on the public internet so no TLS should be fine. Also the localhost.localstack.cloud DNS is not yet set up during login, only when the container starts and it would route to the container, not the CLI.

localhost.localstack.cloud is always set up to redirect to 127.0.0.1, that's how we've registered that domain. We only need the container for the subdomains afaik

I was just wondering if the browser would give any warnings if we didn't use https, but since it's local it should be fine, yes :)

Oh nice, I did not know it was a public DNS. So it should work as well 🤷

add device flow

c147f3b

carole-lavillonniere commented Feb 5, 2026

View reviewed changes

carole-lavillonniere added 2 commits February 5, 2026 21:39

extract startCallbackServer()

f534933

interface for platform client

4f9f64c

carole-lavillonniere force-pushed the carole/drg-450 branch from 780adc5 to e39bd29 Compare February 6, 2026 09:19

carole-lavillonniere commented Feb 6, 2026

View reviewed changes

add mock server for device flow success test

6be9ca5

carole-lavillonniere force-pushed the carole/drg-450 branch from e39bd29 to 6be9ca5 Compare February 6, 2026 11:03

carole-lavillonniere marked this pull request as ready for review February 6, 2026 11:03

carole-lavillonniere requested a review from silv-io as a code owner February 6, 2026 11:03

silv-io reviewed Feb 9, 2026

View reviewed changes

address comments

0bd6650

Conversation

carole-lavillonniere commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User Experience

Mock Server Approach

Uh oh!

carole-lavillonniere Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

carole-lavillonniere Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

silv-io left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

carole-lavillonniere commented Feb 5, 2026 •

edited

Loading

carole-lavillonniere Feb 5, 2026 •

edited

Loading

carole-lavillonniere Feb 6, 2026 •

edited

Loading