Troubleshooting chainctl login

Headless environments

chainctl auth login --headless --org-name <org>

--headless skips browser authentication and uses the device flow. Open the printed URL on a machine with a browser, then paste the code back.

"organization not found, is not verified, or does not have an IDP configured"

Use your verified domain (for example, example.com). For SSO organizations, pass it explicitly: chainctl auth login --org-name=example.com.

Corporate proxy or TLS (SSL) inspection

Allow these hosts to bypass TLS inspection:

# required for the login handshake
issuer.enforce.dev
console-api.enforce.dev
# also needed for social login
auth.chainguard.dev
chainguard.us.auth0.com

# broader recommended allowlist
*.chainguard.dev
*.enforce.dev
cgr.dev
*.sigstore.dev

These hosts are listed on the Network Requirements page. If a proxy mishandles HTTP/2, chainctl auth login --sts-http1-downgrade downgrades STS requests to HTTP/1.x.

Verify your session

chainctl auth status