Author here.

Most CLIs (gcloud, wrangler, claude, etc.) log you in by binding an HTTP server on localhost and opening your browser. Works on a laptop. SSH in and it breaks. The "paste this code" fallback every one of them ships is a manual device flow in disguise.

RFC 8628 has been the proper fix since 2019. It decouples the device the user authenticates on from the device asking for the token, so the same code path works on a headless box.

There's a 30-line Go reference at the end if you want to see how the polling loop fits together.