Problem:

Users working in headless or remote environments (SSH sessions, containers, CI runners, cloud VMs) cannot use the existing acli jira auth login --web OAuth flow because it requires a local browser on the same machine. The only workaround is manually provisioning API tokens, which introduces operational overhead (manual rotation, risk of long-lived credentials, per-user provisioning burden) and undermines the security benefits of short-lived OAuth tokens.

Proposed Solution:

Add a --device flag to acli jira auth login (and acli admin auth login) implementing the OAuth 2.0 Device Authorization Grant (RFC 8628). The flow would:

1. The CLI requests a device code and user code from the Atlassian authorization server
2. The CLI displays a short verification URL and user code in the terminal
3. The user opens the URL in a browser on any device (phone, laptop, etc.), enters the code, and authenticates
4. The CLI polls the token endpoint and completes authentication once the user approves
5. The session is established on the headless machine with no local browser or port forwarding required

Example usage:

$ acli jira auth login --device
To sign in, visit: https://auth.atlassian.com/device
Enter code: ABCD-1234
Waiting for authorization...
Authentication successful! Connected to mysite.atlassian.net

Use Cases:

• Engineers working on remote servers over SSH who need CLI access to Jira

• CI/CD pipelines where interactive OAuth is impossible but API tokens are undesirable

• Cloud-based development environments (Codespaces, Cloud9, etc.) without browser access

• Security-conscious organizations that want to avoid distributing long-lived API tokens

Prior Art:

• GitHub CLI: gh auth login supports device flow by default for headless environments

• Buildkite CLI: bk auth login --device

• Azure CLI: az login --use-device-code

• Google Cloud SDK: gcloud auth login --no-browser

Impact: This would enable secure, token-rotation-free OAuth authentication across all environments without requiring users to manage API tokens manually, reducing credential sprawl and improving security posture.