feat: log in through OAuth 2.0 device code by default

CONTRIBUTING.md

@@ -51,6 +51,22 @@ export APIFY_CONSOLE_URL=http://localhost:3000
 
 Note that if `APIFY_CONSOLE_URL` points at `localhost`, `apify login` validates your token against `http://localhost:3333`. All other commands still call the production API at `https://api.apify.com`.
 
+### `APIFY_CLI_OAUTH_ISSUER_URL`
+
+The OAuth 2.0 authorization server `apify login` talks to. The CLI fetches its RFC 8414 metadata from `<issuer>/.well-known/oauth-authorization-server` and uses the device authorization, authorization and token endpoints it lists.
+
+The default value is `https://console-backend.apify.com`.
+
+### `APIFY_CLI_OAUTH_CLIENT_ID`
+
+The OAuth 2.0 client ID of the CLI. It is the URL of a hosted client metadata document describing the CLI as a public native client.
+
+The default value is `https://apify.com/.well-known/oauth-clients/apify-cli.json`. To test against a differently hosted document, for example a key-value store record, point the variable at its URL:
+
+```bash
+export APIFY_CLI_OAUTH_CLIENT_ID='https://api.apify.com/v2/key-value-stores/<store-id>/records/oidc.json?signature=<signature>'
+```
+
 ## Code style
 
 The repo uses three tools, wired together via a pre-commit hook (`husky` + `lint-staged`):

docs/quick-start.md

@@ -72,10 +72,13 @@ To log in, run:
 apify login
 ```
 
-You can then choose one of the following methods:
+The CLI opens Apify Console in your browser, where you confirm the login. If the browser does not open, visit the printed URL and enter the code shown in your terminal.
 
-- _(Recommended)_ Sign in through the Apify Console in your browser.
-- Provide an [Apify API token](https://console.apify.com/settings/integrations).
+To use an [Apify API token](https://console.apify.com/settings/integrations) instead, pass it directly:
+
+```bash
+apify login --token <your-api-token>
+```
 
 ### Push your Actor to Apify
 

docs/reference.md

@@ -160,14 +160,19 @@ DESCRIPTION
   '~/.apify/auth.json'.
   All other commands use these stored credentials.
 
-  Run 'apify logout' to remove authentication.
+  By default, the login is confirmed in Apify Console in your browser by putting
+   in a code. Run 'apify logout' to remove authentication.
 
 USAGE
-  $ apify auth login [-m console|manual] [-t <value>]
+  $ apify auth login [-m oauth2|console|manual] [-t <value>]
 
 FLAGS
-  -m, --method=<option>  Method of logging in to Apify.
-                         <options: console|manual>
+  -m, --method=<option>  Method of logging in to Apify. The
+                         default method ('oauth2') confirms the login in Apify
+                         Console by putting in a code. The 'manual' method prompts
+                         for an API token. The 'console' method uses the legacy
+                         Console hand-off, which is deprecated.
+                         <options: oauth2|console|manual>
   -t, --token=<value>    Apify API token.
 ```
 
@@ -188,6 +193,8 @@ USAGE
 ```sh
 DESCRIPTION
   Prints the current API token for the Apify CLI.
+  Tokens issued by an OAuth login expire after about an hour; the expiry is 
+  noted on stderr.
 
 USAGE
   $ apify auth token

skills/apify/SKILL.md

@@ -14,15 +14,15 @@ Many commands prompt when run interactively. To run without prompts, pass every
 - `apify create <name> --template <template>` — skip the create wizard.
 - `apify init <name>` — skip the init prompt.
 - `-y` / `--yes` on destructive commands (`apify actors rm`, etc.) — auto-confirm.
-- `apify login --token <token>` — log in without the interactive token prompt.
+- `apify login --token <token>` — log in without the browser confirmation.
 
 If a command's help shows an "interactive note", it lists exactly which flags make it non-interactive.
 
 ## Auth
 
 See https://apify.com/auth.md for how to authenticate. Do not assume `APIFY_TOKEN` is already set in the environment and use it implicitly — confirm with the user first.
 
-- Persist a session explicitly: `apify login --token <token>`.
+- Persist a session explicitly: `apify login --token <token>` (plain `apify login` opens a browser confirmation, which agents cannot complete).
 - Verify auth: `apify info` (prints the logged-in user; non-zero exit / error if not authenticated).
 - Print the stored token: `apify auth token`.