Gemini CLI stuck at 'Waiting for auth' over SSH: how to finish Google OAuth headlessly?
When I run gemini-cli over SSH on a remote server, login hangs at "Waiting for auth... (Press ESC to cancel)" and no URL is shown. On machines without a browser it can crash with "spawn xdg-open ENOENT" (Node v20.19.1) because the CLI tries to open a browser for Google OAuth. How do I complete the OAuth flow when the callback has to reach localhost on the remote machine?
Originally asked on GitHub: https://github.com/google-gemini/gemini-cli/issues/1437
6 answers
Status: the issue is closed, but the thread does not show a code fix. A collaborator explained that printing the URL alone would not help most users because the browser needs to call back to localhost on the machine running the CLI; they pointed to issue #1439 as the feature request.
The workaround that worked in the thread:
- On the remote server run
npx https://github.com/google-gemini/gemini-cli --debug. - Copy the Google auth URL it prints and open it in your local browser.
- After signing in, the browser redirects to a URL like
http://localhost:<port>/oauth2callback.... - Copy the whole callback URL, then in a second terminal on the server run
curl "http://localhost:<port>/oauth2callback...".
A later comment confirms the same flow with plain
gemini --debugand says no SSH forwarding is needed: copy the auth URL, log in on a local browser, copy the localhost callback URL, thencurlit on the machine that is running gemini-cli.Alternative from the thread: SSH local port forwarding. Find the callback port in the
redirect_uriparameter (the example used port 21165), then from your local machine runssh -L 21165:0.0.0.0:21165 <your-ssh-alias>and keep the tunnel open while opening the auth URL in your local browser.Another temporary option suggested in the thread: copy
~/.gemini/oauth_creds.jsonfrom a machine where OAuth succeeded to the same path on the remote server; the tokens expire and need refreshing. General advice: that file contains credentials, so keep it out of shared repos, logs, or other untrusted locations.Did this work for you?- On the remote server run
What a GitHub user tried on GitHub (Worked)
The reporter ran the CLI over SSH, got stuck at "Waiting for auth", then ran
npx https://github.com/google-gemini/gemini-cli --debug, opened the printed auth URL in a browser, copied the resultinghttp://localhost:41725/oauth2callback...URL, and rancurlwith that URL from a second terminal on the server.Source: https://github.com/google-gemini/gemini-cli/issues/1437 (opens external site)
Did this work for you?What @chrissound tried on GitHub (Worked)
A commenter simplified the same flow: run
gemini --debug, copy the auth URL, log in on a local browser, copy the localhost callback URL from the browser, then runcurl "$localhostUrl"on the machine running gemini-cli. They stated no SSH forwarding is needed.Did this work for you?What @ylck tried on GitHub (Outcome unclear)
A commenter posted a full SSH port-forwarding setup: parse the callback port from
redirect_uri(example used port 21165), runssh -L 21165:0.0.0.0:21165 <ssh-alias>from the local machine, and keep the tunnel open while completing Google auth in the local browser.Did this work for you?What @ben-vargas tried on GitHub (Outcome unclear)
A commenter suggested copying
~/.gemini/oauth_creds.jsonfrom a machine where OAuth already worked onto the remote server, noting that the tokens expire.Did this work for you?What @markmcd tried on GitHub (Outcome unclear)
A maintainer suggested as a workaround to set
DISPLAYand tunnel X over SSH so the browser window opens locally.Did this work for you?
Related questions
- gemini-cli 400: "only 'enum' and 'date-time' are supported for STRING type"
- Gemini CLI: API Error 'Model stream ended with an invalid chunk or missing finish reason' after ReadFile or Edit tool calls
- gemini-cli stuck on "This is taking a bit longer" after Esc cancel — is there a fix?
- Is there a way to get codebase indexing in gemini-cli?
- How can I use voice input instead of typing with Gemini CLI?