Hello, i am trying to use the bk cli, but can’t seem to login to it.
I am running on a debian bookworm server (npawn)
i have tried:
bk auth loginbk auth login --devicebk auth login --org <myorg> --token <token>
In all cases, after i get authorized, it just hangs indefinitely and i don’t get authenticated, even if i try running the cli again on another tab.
What am i doing wrong? i’m really not figuring out a way to get this through and i don’t think it’s an issue with the container setup
thanks in advance for your help
after a bunch of claude debugging, it seems that it was trying to clean any stale refresh tokens that might exist in the keyring, but i had a password in it, so it just waited forever on a response from a password prompt that had nowhere to display on.
This happens even in the --device flag situation, which is supposed to be used in a non-interactive manner. This one is a proper bug, i’d say
Hello Zenogueira,
Thank you for digging into this and flagging it with us! What’s happening is when logging in with --org --token, the CLI stores your new token correctly, but then always runs a cleanup step afterward to remove any old OAuth refresh token, and that step reaches into your system’s real keyring no matter what credential store you’ve configured. If that keyring is locked behind a password with nowhere to display an unlock prompt (as on your headless server), it hangs forever with no timeout.
However to get you unblocked, you can use this instead:
bk auth login --device --credential-store shm
I’ve tested this combination directly and confirmed it never touches the real system keyring at any step, so it isn’t affected by this bug. But one tradeoff is since it’s stored in memory (/dev/shm), you’ll need to log in again after a reboot.
Unfortunately, there’s no workaround yet for --org --token itself that keeps your login persisted. The cleanup step can’t be avoided without also disabling storage entirely, which would mean passing your token manually via BUILDKITE_API_TOKEN on every command. So for now, the --device command above is the way to go.
However, I’m going to raise this on my side so --org --token gets fixed to respect the configured credential store.
Please reach out if you have any questions! 
Cheers,
Meghana
Senior Support Engineer