feat: add OAuth Authorization Code + PKCE flow for SSO login (#923)

dgilmanuni · claude · web-flow · commit 25a104cf355e · 2026-03-28T19:08:21.000Z
* feat: add OAuth Authorization Code + PKCE flow for SSO login Replace the device code flow as the default SSO login method with the Authorization Code Grant + PKCE flow, matching the AWS CLI's Nov 2024 update. This provides a smoother UX by skipping manual code entry — the browser redirects back automatically via a temporary localhost callback server. The device code flow is preserved as a fallback via --use-device-code flag or automatic headless environment detection (SSH, Docker, CI). Key changes: - New LoginWithAuthorizationCode function implementing RFC 7636 PKCE - Extracted browser-opening logic into reusable browser.go module - Headless environment detection for automatic flow selection - Upgraded ssooidc SDK to v1.35.15 for authorization_code grant support - Security headers (CSP, X-Content-Type-Options, X-Frame-Options) on callback pages - Comprehensive tests including RFC 7636 test vectors and XSS prevention Closes #779 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: make authorization code + PKCE flow opt-in instead of default Device code flow remains the default SSO login method. The PKCE authorization code flow is now opt-in via --use-authorization-code flag or UseAuthorizationCode config setting, reducing risk of breaking existing users behind proxies or restricted networks. - Add UseAuthorizationCode to Config and ConfigOpts structs - Add --use-authorization-code flag to login, assume, generate, populate - Add --use-device-code flag to generate and populate commands - Thread config through all ConfigOpts construction sites - Log warning when headless detection overrides PKCE preference - Remove SSOSessionName as implicit PKCE trigger in assume path Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
diff --git a/go.mod b/go.mod
@@ -5,10 +5,10 @@ go 1.25.7
 require (
 	github.com/99designs/keyring v1.2.2
 	github.com/AlecAivazis/survey/v2 v2.3.7
-	github.com/aws/aws-sdk-go-v2 v1.26.1
+	github.com/aws/aws-sdk-go-v2 v1.41.2
 	github.com/aws/aws-sdk-go-v2/config v1.27.11
 	github.com/aws/aws-sdk-go-v2/service/sso v1.20.5
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.15
 	github.com/aws/aws-sdk-go-v2/service/sts v1.28.6
 	github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8
 	github.com/pkg/errors v0.9.1
@@ -62,12 +62,12 @@ require (
 	github.com/BurntSushi/toml v1.3.2
 	github.com/aws/aws-sdk-go-v2/credentials v1.17.11
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.18 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.18 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/iam v1.28.7
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7 // indirect
-	github.com/aws/smithy-go v1.20.2
+	github.com/aws/smithy-go v1.24.1
 	github.com/common-fate/awsconfigfile v0.10.0
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
 	github.com/danieljoos/wincred v1.1.2 // indirect
diff --git a/go.sum b/go.sum
@@ -16,18 +16,18 @@ github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63n
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
 github.com/alessio/shellescape v1.4.2 h1:MHPfaU+ddJ0/bYWpgIeUnQUqKrlJ1S7BfEYPM4uEoM0=
 github.com/alessio/shellescape v1.4.2/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30=
-github.com/aws/aws-sdk-go-v2 v1.26.1 h1:5554eUqIYVWpU0YmeeYZ0wU64H2VLBs8TlhRB2L+EkA=
-github.com/aws/aws-sdk-go-v2 v1.26.1/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM=
+github.com/aws/aws-sdk-go-v2 v1.41.2 h1:LuT2rzqNQsauaGkPK/7813XxcZ3o3yePY0Iy891T2ls=
+github.com/aws/aws-sdk-go-v2 v1.41.2/go.mod h1:IvvlAZQXvTXznUPfRVfryiG1fbzE2NGK6m9u39YQ+S4=
 github.com/aws/aws-sdk-go-v2/config v1.27.11 h1:f47rANd2LQEYHda2ddSCKYId18/8BhSRM4BULGmfgNA=
 github.com/aws/aws-sdk-go-v2/config v1.27.11/go.mod h1:SMsV78RIOYdve1vf36z8LmnszlRWkwMQtomCAI0/mIE=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.11 h1:YuIB1dJNf1Re822rriUOTxopaHHvIq0l/pX3fwO+Tzs=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.11/go.mod h1:AQtFPsDH9bI2O+71anW6EKL+NcD7LG3dpKGMV4SShgo=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 h1:FVJ0r5XTHSmIHJV6KuDmdYhEpvlHpiSd38RQWhut5J4=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1/go.mod h1:zusuAeqezXzAB24LGuzuekqMAEgWkVYukBec3kr3jUg=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 h1:aw39xVGeRWlWx9EzGVnhOR4yOjQDHPQ6o6NmBlscyQg=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5/go.mod h1:FSaRudD0dXiMPK2UjknVwwTYyZMRsHv3TtkabsZih5I=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 h1:PG1F3OD1szkuQPzDw3CIQsRIrtTlUC3lP84taWzHlq0=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5/go.mod h1:jU1li6RFryMz+so64PpKtudI+QzbKoIEivqdf6LNpOc=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.18 h1:F43zk1vemYIqPAwhjTjYIz0irU2EY7sOb/F5eJ3HuyM=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.18/go.mod h1:w1jdlZXrGKaJcNoL+Nnrj+k5wlpGXqnNrKoP22HvAug=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.18 h1:xCeWVjj0ki0l3nruoyP2slHsGArMxeiiaoPN5QZH6YQ=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.18/go.mod h1:r/eLGuGCBw6l36ZRWiw6PaZwPXb6YOj+i/7MizNl5/k=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
 github.com/aws/aws-sdk-go-v2/service/iam v1.28.7 h1:FKPRDYZOO0Eur19vWUL1B40Op0j89KQj3kARjrszMK8=
@@ -38,12 +38,12 @@ github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7 h1:ogRAwT1/g
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7/go.mod h1:YCsIZhXfRPLFFCl5xxY+1T9RKzOKjCut+28JSX2DnAk=
 github.com/aws/aws-sdk-go-v2/service/sso v1.20.5 h1:vN8hEbpRnL7+Hopy9dzmRle1xmDc7o8tmY0klsr175w=
 github.com/aws/aws-sdk-go-v2/service/sso v1.20.5/go.mod h1:qGzynb/msuZIE8I75DVRCUXw3o3ZyBmUvMwQ2t/BrGM=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4 h1:Jux+gDDyi1Lruk+KHF91tK2KCuY61kzoCpvtvJJBtOE=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4/go.mod h1:mUYPBhaF2lGiukDEjJX2BLRRKTmoUSitGDUgM4tRxak=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.15 h1:edCcNp9eGIUDUCrzoCu1jWAXLGFIizeqkdkKgRlJwWc=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.15/go.mod h1:lyRQKED9xWfgkYC/wmmYfv7iVIM68Z5OQ88ZdcV1QbU=
 github.com/aws/aws-sdk-go-v2/service/sts v1.28.6 h1:cwIxeBttqPN3qkaAjcEcsh8NYr8n2HZPkcKgPAi1phU=
 github.com/aws/aws-sdk-go-v2/service/sts v1.28.6/go.mod h1:FZf1/nKNEkHdGGJP/cI2MoIMquumuRK6ol3QQJNDxmw=
-github.com/aws/smithy-go v1.20.2 h1:tbp628ireGtzcHDDmLT/6ADHidqnwgF57XOXZe6tp4Q=
-github.com/aws/smithy-go v1.20.2/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
+github.com/aws/smithy-go v1.24.1 h1:VbyeNfmYkWoxMVpGUAbQumkODcYmfMRfZ8yQiH30SK0=
+github.com/aws/smithy-go v1.24.1/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/benbjohnson/clock v1.3.5 h1:VvXlSJBzZpA/zum6Sj74hxwYI2DIxRWuNIoXAzHZz5o=
 github.com/benbjohnson/clock v1.3.5/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/common-fate/awsconfigfile v0.10.0 h1:9W0JTeO0d3jNLw3Ps9U7IJwLYp4D9zcipq/sqNEWJOg=
@@ -63,8 +63,6 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dvsekhvalnov/jose2go v1.6.0 h1:Y9gnSnP4qEI0+/uQkHvFXeD2PLPJeXEL+ySMEA2EjTY=
-github.com/dvsekhvalnov/jose2go v1.6.0/go.mod h1:QsHjhyTlD/lAVqn/NSbVZmSCGeDehTB/mPZadG+mhXU=
 github.com/dvsekhvalnov/jose2go v1.8.0 h1:LqkkVKAlHFfH9LOEl5fe4p/zL02OhWE7pCufMBG2jLA=
 github.com/dvsekhvalnov/jose2go v1.8.0/go.mod h1:QsHjhyTlD/lAVqn/NSbVZmSCGeDehTB/mPZadG+mhXU=
 github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
diff --git a/pkg/assume/assume.go b/pkg/assume/assume.go
@@ -306,6 +306,8 @@ func AssumeCommand(c *cli.Context) error {
 		return err
 	}
 
+	configOpts.UseAuthorizationCode = assumeFlags.Bool("use-authorization-code") || cfg.UseAuthorizationCode
+
 	// if getConsoleURL is true, we'll use the AWS federated login to retrieve a URL to access the console.
 	// depending on how Granted is configured, this is then printed to the terminal or a browser is launched at the URL automatically.
 	getConsoleURL := !assumeFlags.Bool("env") && ((assumeFlags.Bool("console") || assumeFlags.String("console-destination") != "") || assumeFlags.Bool("active-role") || assumeFlags.String("service") != "" || assumeFlags.Bool("url"))
diff --git a/pkg/assume/entrypoint.go b/pkg/assume/entrypoint.go
@@ -59,6 +59,7 @@ func GlobalFlags() []cli.Flag {
 		&cli.StringSliceFlag{Name: "browser-launch-template-arg", Usage: "Additional arguments to provide to the browser launch template command in key=value format, e.g. '--browser-launch-template-arg foo=bar"},
 		&cli.BoolFlag{Name: "skip-profile-registry-sync", Usage: "You can use this to skip the automated profile registry sync process."},
 		&cli.StringSliceFlag{Name: "attach", Usage: "Attach justifications to your request, such as a Jira ticket id or url `--attach=TP-123`"},
+		&cli.BoolFlag{Name: "use-authorization-code", Usage: "Use authorization code flow with PKCE for SSO login"},
 	}
 }
 
diff --git a/pkg/cfaws/assumer_aws_sso.go b/pkg/cfaws/assumer_aws_sso.go
@@ -192,7 +192,21 @@ func (c *Profile) SSOLogin(ctx context.Context, configOpts ConfigOpts) (aws.Cred
 	if cachedToken == nil && plainTextToken == nil {
 		newCfg := aws.NewConfig()
 		newCfg.Region = rootProfile.SSORegion()
-		newSSOToken, err := idclogin.Login(ctx, *newCfg, rootProfile.SSOStartURL(), rootProfile.SSOScopes(), configOpts.SSOBrowserProfile)
+
+		var newSSOToken *securestorage.SSOToken
+		var err error
+
+		// Use device code by default. Authorization code with PKCE is used only
+		// when explicitly opted in via flag or config, and not in headless environments.
+		useDeviceCode := configOpts.UseDeviceCode || idclogin.IsHeadlessEnvironment()
+		if configOpts.UseAuthorizationCode && useDeviceCode && idclogin.IsHeadlessEnvironment() {
+			clio.Warn("Headless environment detected, falling back to device code flow instead of authorization code")
+		}
+		if configOpts.UseAuthorizationCode && !useDeviceCode {
+			newSSOToken, err = idclogin.LoginWithAuthorizationCode(ctx, *newCfg, rootProfile.SSOStartURL(), rootProfile.SSOScopes(), configOpts.SSOBrowserProfile)
+		} else {
+			newSSOToken, err = idclogin.Login(ctx, *newCfg, rootProfile.SSOStartURL(), rootProfile.SSOScopes(), configOpts.SSOBrowserProfile)
+		}
 		if err != nil {
 			return aws.Credentials{}, err
 		}
diff --git a/pkg/cfaws/creds.go b/pkg/cfaws/creds.go
@@ -82,7 +82,7 @@ func GetAWSCredentials(ctx context.Context) (*aws.Credentials, error) {
 		duration = *profile.AWSConfig.RoleDurationSeconds
 	}
 
-	credentials, err := profile.AssumeTerminal(ctx, ConfigOpts{Duration: duration, UsingCredentialProcess: true, CredentialProcessAutoLogin: true})
+	credentials, err := profile.AssumeTerminal(ctx, ConfigOpts{Duration: duration, UsingCredentialProcess: true, CredentialProcessAutoLogin: true, UseAuthorizationCode: cfg.UseAuthorizationCode})
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/cfaws/profiles.go b/pkg/cfaws/profiles.go
@@ -28,6 +28,8 @@ type ConfigOpts struct {
 	MFATokenCode               string
 	DisableCache               bool
 	SSOBrowserProfile          string
+	UseDeviceCode              bool
+	UseAuthorizationCode       bool
 }
 
 type Profile struct {
diff --git a/pkg/config/config.go b/pkg/config/config.go
@@ -91,6 +91,14 @@ type Config struct {
 	// will cause Granted to hang during the login process.
 	CredentialProcessAutoLogin bool `toml:",omitempty"`
 
+	// UseAuthorizationCode, if 'true', will use the OAuth Authorization Code
+	// with PKCE flow for SSO login instead of the default device code flow.
+	//
+	// This provides a smoother login experience by skipping manual code entry,
+	// but requires a local browser that can redirect to 127.0.0.1.
+	// Do not set this to 'true' on headless systems.
+	UseAuthorizationCode bool `toml:",omitempty"`
+
 	SSO map[string]AWSSSOConfiguration `toml:",omitempty"`
 }
 
diff --git a/pkg/granted/credential_process.go b/pkg/granted/credential_process.go
@@ -90,7 +90,7 @@ var CredentialProcess = cli.Command{
 			duration = *profile.AWSConfig.RoleDurationSeconds
 		}
 
-		credentials, err := profile.AssumeTerminal(c.Context, cfaws.ConfigOpts{Duration: duration, UsingCredentialProcess: true, CredentialProcessAutoLogin: autoLogin})
+		credentials, err := profile.AssumeTerminal(c.Context, cfaws.ConfigOpts{Duration: duration, UsingCredentialProcess: true, CredentialProcessAutoLogin: autoLogin, UseAuthorizationCode: cfg.UseAuthorizationCode})
 		if err != nil {
 			return err
 		}
diff --git a/pkg/granted/doctor/doctor.go b/pkg/granted/doctor/doctor.go
@@ -220,9 +220,14 @@ func (d *GrantedDoctor) CheckAllAWSKeychainTokens(ctx context.Context) error {
 func (d *GrantedDoctor) CheckValidCredentials(ctx context.Context, token cfaws.SSOPlainTextOut) error {
 	secureSSOTokenStorage := securestorage.NewSecureSSOTokenStorage()
 
+	gCfg, err := grantedConfig.Load()
+	if err != nil {
+		return err
+	}
+
 	cfg := aws.NewConfig()
 	cfg.Region = d.Profile.SSORegion()
-	creds, err := d.Profile.SSOLoginWithToken(ctx, cfg, &token.AccessToken, secureSSOTokenStorage, cfaws.ConfigOpts{})
+	creds, err := d.Profile.SSOLoginWithToken(ctx, cfg, &token.AccessToken, secureSSOTokenStorage, cfaws.ConfigOpts{UseAuthorizationCode: gCfg.UseAuthorizationCode})
 	if _, ok := err.(cfaws.NoAccessError); ok {
 		clio.Info("No access to current profile, skipping...\n")
 		return nil
diff --git a/pkg/granted/sso.go b/pkg/granted/sso.go
@@ -57,6 +57,7 @@ var GenerateCommand = cli.Command{
 		&cli.BoolFlag{Name: "no-credential-process", Usage: "Generate profiles without the Granted credential-process integration"},
 		&cli.StringFlag{Name: "profile-template", Usage: "Specify profile name template", Value: awsconfigfile.DefaultProfileNameTemplate},
 		&cli.StringFlag{Name: "sso-browser-profile", Usage: "Use a pre-existing profile in your browser for SSO login", EnvVars: []string{"GRANTED_SSO_BROWSER_PROFILE"}},
+		&cli.BoolFlag{Name: "use-device-code", Usage: "Force device code flow even if authorization code with PKCE is enabled"},
 	},
 	Action: func(c *cli.Context) error {
 		ctx := c.Context
@@ -106,7 +107,7 @@ var GenerateCommand = cli.Command{
 		for _, s := range c.StringSlice("source") {
 			switch s {
 			case "aws-sso":
-				g.AddSource(AWSSSOSource{SSORegion: ssoRegion, StartURL: startURL, SSOBrowserProfile: ssoBrowserProfile})
+				g.AddSource(AWSSSOSource{SSORegion: ssoRegion, StartURL: startURL, SSOBrowserProfile: ssoBrowserProfile, UseDeviceCode: c.Bool("use-device-code")})
 			case "commonfate", "common-fate", "cf":
 				return fmt.Errorf("the common fate profile source is no longer supported: https://www.commonfate.io/blog/winding-down")
 			default:
@@ -142,6 +143,7 @@ var PopulateCommand = cli.Command{
 		&cli.StringFlag{Name: "profile-template", Usage: "Specify profile name template", Value: awsconfigfile.DefaultProfileNameTemplate},
 		&cli.BoolFlag{Name: "no-credential-process", Usage: "Generate profiles without the Granted credential-process integration"},
 		&cli.StringFlag{Name: "sso-browser-profile", Usage: "Use a pre-existing profile in your browser for SSO login", EnvVars: []string{"GRANTED_SSO_BROWSER_PROFILE"}},
+		&cli.BoolFlag{Name: "use-device-code", Usage: "Force device code flow even if authorization code with PKCE is enabled"},
 	},
 	Action: func(c *cli.Context) error {
 		ctx := c.Context
@@ -222,7 +224,7 @@ var PopulateCommand = cli.Command{
 		for _, s := range c.StringSlice("source") {
 			switch s {
 			case "aws-sso":
-				g.AddSource(AWSSSOSource{SSORegion: ssoRegion, StartURL: startURL, SSOScopes: c.StringSlice("sso-scope"), SSOBrowserProfile: ssoBrowserProfile})
+				g.AddSource(AWSSSOSource{SSORegion: ssoRegion, StartURL: startURL, SSOScopes: c.StringSlice("sso-scope"), SSOBrowserProfile: ssoBrowserProfile, UseDeviceCode: c.Bool("use-device-code")})
 			case "commonfate", "common-fate", "cf":
 				return fmt.Errorf("the common fate profile source is no longer supported: https://www.commonfate.io/blog/winding-down")
 			default:
@@ -251,6 +253,8 @@ var LoginCommand = cli.Command{
 		&cli.StringFlag{Name: "sso-start-url", Usage: "Specify the SSO start url"},
 		&cli.StringSliceFlag{Name: "sso-scope", Usage: "Specify the SSO scopes"},
 		&cli.StringFlag{Name: "sso-browser-profile", Usage: "Use a pre-existing profile in your browser for SSO login", EnvVars: []string{"GRANTED_SSO_BROWSER_PROFILE"}},
+		&cli.BoolFlag{Name: "use-device-code", Usage: "Force device code flow even if authorization code with PKCE is enabled"},
+		&cli.BoolFlag{Name: "use-authorization-code", Usage: "Use authorization code flow with PKCE instead of device code"},
 	},
 	Action: func(c *cli.Context) error {
 		ctx := c.Context
@@ -299,12 +303,28 @@ var LoginCommand = cli.Command{
 		ssoScopes := c.StringSlice("sso-scope")
 		ssoBrowserProfile := c.String("sso-browser-profile")
 
+		grantedCfg, err := grantedconfig.Load()
+		if err != nil {
+			return err
+		}
+
 		cfg := aws.NewConfig()
 		cfg.Region = ssoRegion
 
 		secureSSOTokenStorage := securestorage.NewSecureSSOTokenStorage()
 
-		newSSOToken, err := idclogin.Login(ctx, *cfg, ssoStartUrl, ssoScopes, ssoBrowserProfile)
+		var newSSOToken *securestorage.SSOToken
+
+		useAuthCode := c.Bool("use-authorization-code") || grantedCfg.UseAuthorizationCode
+		isHeadless := idclogin.IsHeadlessEnvironment()
+		if useAuthCode && isHeadless {
+			clio.Warn("Headless environment detected, falling back to device code flow instead of authorization code")
+		}
+		if useAuthCode && !isHeadless && !c.Bool("use-device-code") {
+			newSSOToken, err = idclogin.LoginWithAuthorizationCode(ctx, *cfg, ssoStartUrl, ssoScopes, ssoBrowserProfile)
+		} else {
+			newSSOToken, err = idclogin.Login(ctx, *cfg, ssoStartUrl, ssoScopes, ssoBrowserProfile)
+		}
 		if err != nil {
 			return err
 		}
@@ -322,6 +342,7 @@ type AWSSSOSource struct {
 	StartURL          string
 	SSOScopes         []string
 	SSOBrowserProfile string
+	UseDeviceCode     bool
 }
 
 func (s AWSSSOSource) GetProfiles(ctx context.Context) ([]awsconfigfile.SSOProfile, error) {
@@ -355,8 +376,22 @@ func (s AWSSSOSource) GetProfiles(ctx context.Context) ([]awsconfigfile.SSOProfi
 	}
 
 	if ssoTokenFromSecureCache == nil && ssoTokenFromPlainText == nil {
-		// otherwise, login with SSO
-		ssoTokenFromSecureCache, err = idclogin.Login(ctx, cfg, s.StartURL, s.SSOScopes, s.SSOBrowserProfile)
+		grantedCfg, err := grantedconfig.Load()
+		if err != nil {
+			return nil, err
+		}
+
+		// Login with SSO, using device code by default unless authorization code is opted in
+		useAuthCode := grantedCfg.UseAuthorizationCode && !s.UseDeviceCode
+		isHeadless := idclogin.IsHeadlessEnvironment()
+		if useAuthCode && isHeadless {
+			clio.Warn("Headless environment detected, falling back to device code flow instead of authorization code")
+		}
+		if useAuthCode && !isHeadless {
+			ssoTokenFromSecureCache, err = idclogin.LoginWithAuthorizationCode(ctx, cfg, s.StartURL, s.SSOScopes, s.SSOBrowserProfile)
+		} else {
+			ssoTokenFromSecureCache, err = idclogin.Login(ctx, cfg, s.StartURL, s.SSOScopes, s.SSOBrowserProfile)
+		}
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/idclogin/authcode.go b/pkg/idclogin/authcode.go
diff --git a/pkg/idclogin/authcode_test.go b/pkg/idclogin/authcode_test.go
diff --git a/pkg/idclogin/browser.go b/pkg/idclogin/browser.go
diff --git a/pkg/idclogin/headless.go b/pkg/idclogin/headless.go
diff --git a/pkg/idclogin/run.go b/pkg/idclogin/run.go

Original file line number	Diff line number	Diff line change
`@@ -306,6 +306,8 @@ func AssumeCommand(c *cli.Context) error {`
`306`	`306`	`return err`
`307`	`307`	`}`
`308`	`308`
	`309`	`+ configOpts.UseAuthorizationCode = assumeFlags.Bool("use-authorization-code") \|\| cfg.UseAuthorizationCode`
	`310`	`+`
`309`	`311`	`// if getConsoleURL is true, we'll use the AWS federated login to retrieve a URL to access the console.`
`310`	`312`	`// depending on how Granted is configured, this is then printed to the terminal or a browser is launched at the URL automatically.`
`311`	`313`	`getConsoleURL := !assumeFlags.Bool("env") && ((assumeFlags.Bool("console") \|\| assumeFlags.String("console-destination") != "") \|\| assumeFlags.Bool("active-role") \|\| assumeFlags.String("service") != "" \|\| assumeFlags.Bool("url"))`
Original file line number	Diff line number	Diff line change
`@@ -59,6 +59,7 @@ func GlobalFlags() []cli.Flag {`
`59`	`59`	`&cli.StringSliceFlag{Name: "browser-launch-template-arg", Usage: "Additional arguments to provide to the browser launch template command in key=value format, e.g. '--browser-launch-template-arg foo=bar"},`
`60`	`60`	`&cli.BoolFlag{Name: "skip-profile-registry-sync", Usage: "You can use this to skip the automated profile registry sync process."},`
`61`	`61`	&cli.StringSliceFlag{Name: "attach", Usage: "Attach justifications to your request, such as a Jira ticket id or url `--attach=TP-123`"},
	`62`	`+ &cli.BoolFlag{Name: "use-authorization-code", Usage: "Use authorization code flow with PKCE for SSO login"},`
`62`	`63`	`}`
`63`	`64`	`}`
`64`	`65`
Original file line number	Diff line number	Diff line change
`@@ -82,7 +82,7 @@ func GetAWSCredentials(ctx context.Context) (*aws.Credentials, error) {`
`82`	`82`	`duration = *profile.AWSConfig.RoleDurationSeconds`
`83`	`83`	`}`
`84`	`84`
`85`		`- credentials, err := profile.AssumeTerminal(ctx, ConfigOpts{Duration: duration, UsingCredentialProcess: true, CredentialProcessAutoLogin: true})`
	`85`	`+ credentials, err := profile.AssumeTerminal(ctx, ConfigOpts{Duration: duration, UsingCredentialProcess: true, CredentialProcessAutoLogin: true, UseAuthorizationCode: cfg.UseAuthorizationCode})`
`86`	`86`	`if err != nil {`
`87`	`87`	`return nil, err`
`88`	`88`	`}`
Original file line number	Diff line number	Diff line change
`@@ -28,6 +28,8 @@ type ConfigOpts struct {`
`28`	`28`	`MFATokenCode string`
`29`	`29`	`DisableCache bool`
`30`	`30`	`SSOBrowserProfile string`
	`31`	`+ UseDeviceCode bool`
	`32`	`+ UseAuthorizationCode bool`
`31`	`33`	`}`
`32`	`34`
`33`	`35`	`type Profile struct {`
Original file line number	Diff line number	Diff line change
`@@ -90,7 +90,7 @@ var CredentialProcess = cli.Command{`
`90`	`90`	`duration = *profile.AWSConfig.RoleDurationSeconds`
`91`	`91`	`}`
`92`	`92`
`93`		`- credentials, err := profile.AssumeTerminal(c.Context, cfaws.ConfigOpts{Duration: duration, UsingCredentialProcess: true, CredentialProcessAutoLogin: autoLogin})`
	`93`	`+ credentials, err := profile.AssumeTerminal(c.Context, cfaws.ConfigOpts{Duration: duration, UsingCredentialProcess: true, CredentialProcessAutoLogin: autoLogin, UseAuthorizationCode: cfg.UseAuthorizationCode})`
`94`	`94`	`if err != nil {`
`95`	`95`	`return err`
`96`	`96`	`}`