Browser login by default
PKCE in the browser; device code stays available for headless sessions.
One selector for every identity
Work email, Entra domain, tenant GUID or organization name all work.
One question instead of several
dxs init asks for your work email and works out the tenant.
Sign-in and onboarding
-
Browser sign-in by defaultChanged#180
Interactive login uses the browser with PKCE. Device-code login remains automatic in headless sessions and available explicitly through
--use-device-codeor--no-browser. Agent output stays structured, with human-facing prompts on stderr. -
One way to select an identityNew#180
auth login,auth switchandinitaccept a work email, Entra domain, tenant GUID or organization name. Initialization replaces several tenant questions with one work-email prompt. Valid cached identities are reused, refreshable sessions renew silently, and--forcestarts a fresh login. -
More reliable customer authenticationFix#180
Login verifies that the returned account matches the one requested, uses the correct tenant authority for Footprint tokens, and gives clearer guidance for consent, guest-account and Conditional Access failures.
Behind the scenes
-
Blocking type checks and quieter CITooling#178#179
All pre-existing mypy errors were fixed and type checking now blocks CI. Workflow actions moved to Node 24 releases, clearing deprecation and mirror warnings.
What might need a change on your side
- Scripts that sign in. Interactive login now opens a browser. In automation, pass
--use-device-codeor--no-browser, or run without a TTY.
Source record
Compiled from the 3 pull requests merged to main between v0.4.25 and v0.5.0, assigned by tag ancestry. Deploy-pin and version-bump commits are omitted. Dates use America/New_York.