From 70089dcd9b0d4391dfe95556c89371740140cfc2 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Thu, 29 Oct 2026 12:01:40 +0000
Subject: [PATCH 01/29] Add a non-interactive device code login

When stdin is not a terminal, e.g. when an AI agent runs it, auth login
--use-device-code stores the device code as a pending login in the token
store and prints the URL and the user code. Rerunning the command with
the hidden --user-code and --confirmation-code flags completes the
login. The device code stays on the machine, so a confirmation code in
an agent's transcript cannot complete the login elsewhere.

The pending login is a new PendingLogin field of storage.Entry, and auth
logout deletes it together with the token. The flow is picked with the
new cmdio.IsInputTTY.

The interactive login tests piped the code into stdin, which now starts
the non-interactive login, so they move from acceptance tests to the
terminal emulator.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 .../cmd/auth/login/device-code/nominal/script |  20 --
 .../auth/login/device-code/nominal/test.toml  |   1 -
 .../concurrent}/out.test.toml                 |   0
 .../non-interactive/concurrent/output.txt     |  60 +++++
 .../non-interactive/concurrent/script         |  23 ++
 .../errors/home/.databrickscfg.tmpl           |   4 +
 .../errors}/out.test.toml                     |   0
 .../non-interactive/errors/output.txt         |  90 ++++++++
 .../device-code/non-interactive/errors/script |  56 +++++
 .../flags/home/.databrickscfg.tmpl            |   5 +
 .../non-interactive/flags/out.databrickscfg   |  15 ++
 .../non-interactive/flags/out.test.toml       |   1 +
 .../non-interactive/flags/output.txt          |  36 +++
 .../device-code/non-interactive/flags/script  |  16 ++
 .../nominal/out.databrickscfg                 |   6 -
 .../non-interactive/nominal/out.test.toml     |   1 +
 .../{ => non-interactive}/nominal/output.txt  |  79 +++++--
 .../non-interactive/nominal/script            |  35 +++
 .../non-interactive/script.prepare            |  13 ++
 .../device-code/non-interactive/test.toml     |   3 +
 .../device-code/unsupported-host/output.txt   |   2 +-
 .../login/device-code/unsupported-host/script |   2 +-
 .../login/device-code/wrong-code/output.txt   |  40 ----
 .../auth/login/device-code/wrong-code/script  |  13 --
 .../pending-device-code-login/out.test.toml   |   1 +
 .../pending-device-code-login/output.txt      |  19 ++
 .../logout/pending-device-code-login/script   |  38 ++++
 cmd/auth/README.md                            |  34 +++
 cmd/auth/login.go                             |  53 ++++-
 cmd/auth/login_device_code.go                 | 138 ++++++++++++
 cmd/auth/login_device_code_test.go            | 210 ++++++++++++++++--
 cmd/auth/logout.go                            |   8 +
 docs/device-code-login.md                     |  61 ++++-
 libs/auth/storage/filestore.go                |   5 +-
 libs/auth/storage/filestore_test.go           |  22 ++
 libs/auth/storage/keyring.go                  |   3 +-
 libs/auth/storage/keyring_test.go             |  13 ++
 libs/auth/storage/memory.go                   |   4 +
 libs/auth/storage/memory_test.go              |  18 ++
 libs/auth/storage/storage.go                  |  19 +-
 libs/auth/u2m/device_code.go                  |   6 +-
 libs/auth/u2m/device_code_test.go             |   2 +-
 libs/cmdio/io.go                              |   9 +
 libs/cmdio/io_test.go                         |  13 ++
 44 files changed, 1066 insertions(+), 131 deletions(-)
 delete mode 100644 acceptance/cmd/auth/login/device-code/nominal/script
 delete mode 100644 acceptance/cmd/auth/login/device-code/nominal/test.toml
 rename acceptance/cmd/auth/login/device-code/{nominal => non-interactive/concurrent}/out.test.toml (100%)
 create mode 100644 acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt
 create mode 100644 acceptance/cmd/auth/login/device-code/non-interactive/concurrent/script
 create mode 100644 acceptance/cmd/auth/login/device-code/non-interactive/errors/home/.databrickscfg.tmpl
 rename acceptance/cmd/auth/login/device-code/{wrong-code => non-interactive/errors}/out.test.toml (100%)
 create mode 100644 acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
 create mode 100644 acceptance/cmd/auth/login/device-code/non-interactive/errors/script
 create mode 100644 acceptance/cmd/auth/login/device-code/non-interactive/flags/home/.databrickscfg.tmpl
 create mode 100644 acceptance/cmd/auth/login/device-code/non-interactive/flags/out.databrickscfg
 create mode 100644 acceptance/cmd/auth/login/device-code/non-interactive/flags/out.test.toml
 create mode 100644 acceptance/cmd/auth/login/device-code/non-interactive/flags/output.txt
 create mode 100644 acceptance/cmd/auth/login/device-code/non-interactive/flags/script
 rename acceptance/cmd/auth/login/device-code/{ => non-interactive}/nominal/out.databrickscfg (68%)
 create mode 100644 acceptance/cmd/auth/login/device-code/non-interactive/nominal/out.test.toml
 rename acceptance/cmd/auth/login/device-code/{ => non-interactive}/nominal/output.txt (52%)
 create mode 100644 acceptance/cmd/auth/login/device-code/non-interactive/nominal/script
 create mode 100644 acceptance/cmd/auth/login/device-code/non-interactive/script.prepare
 create mode 100644 acceptance/cmd/auth/login/device-code/non-interactive/test.toml
 delete mode 100644 acceptance/cmd/auth/login/device-code/wrong-code/output.txt
 delete mode 100644 acceptance/cmd/auth/login/device-code/wrong-code/script
 create mode 100644 acceptance/cmd/auth/logout/pending-device-code-login/out.test.toml
 create mode 100644 acceptance/cmd/auth/logout/pending-device-code-login/output.txt
 create mode 100644 acceptance/cmd/auth/logout/pending-device-code-login/script

diff --git a/acceptance/cmd/auth/login/device-code/nominal/script b/acceptance/cmd/auth/login/device-code/nominal/script
deleted file mode 100644
index f1d6c04f59a..00000000000
--- a/acceptance/cmd/auth/login/device-code/nominal/script
+++ /dev/null
@@ -1,20 +0,0 @@
-sethome "./home"
-
-title "Login with a host\n"
-printf "FTFA-QQKY\n" | trace $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code
-trace $CLI auth token --profile test | gron.py | grep access_token
-trace $CLI auth profiles
-
-title "Login again with the host from the saved profile\n"
-printf "FTFA-QQKY\n" | trace $CLI auth login --profile test --use-device-code
-trace $CLI auth token --profile test | gron.py | grep access_token
-trace print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
-
-# The token gets the scopes requested at device authorization, so --scopes is
-# sent there and not with the token request.
-title "Login with custom scopes\n"
-printf "FTFA-QQKY\n" | trace $CLI auth login --host $DATABRICKS_HOST --profile scoped --use-device-code --scopes sql
-trace print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
-
-# Track the .databrickscfg file that was created to surface changes.
-mv "./home/.databrickscfg" "./out.databrickscfg"
diff --git a/acceptance/cmd/auth/login/device-code/nominal/test.toml b/acceptance/cmd/auth/login/device-code/nominal/test.toml
deleted file mode 100644
index 159efe02696..00000000000
--- a/acceptance/cmd/auth/login/device-code/nominal/test.toml
+++ /dev/null
@@ -1 +0,0 @@
-RecordRequests = true
diff --git a/acceptance/cmd/auth/login/device-code/nominal/out.test.toml b/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/out.test.toml
similarity index 100%
rename from acceptance/cmd/auth/login/device-code/nominal/out.test.toml
rename to acceptance/cmd/auth/login/device-code/non-interactive/concurrent/out.test.toml
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt
new file mode 100644
index 00000000000..641900bd214
--- /dev/null
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt
@@ -0,0 +1,60 @@
+
+=== A second login for the same profile replaces the first
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
+
+>>> update_file.py home/.databricks/token-cache.json WDJBMJHT NEWRCODE
+
+>>> cache_keys
+[
+  "test#device-code"
+]
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Error: a newer login for profile test replaced this one. Complete the newer login with its user code. Run the same command without --user-code and --confirmation-code to start a new login
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code NEWR-CODE --confirmation-code FTFA-QQKY
+Profile test was successfully saved
+
+>>> print_requests.py --oneline //oidc/v1/token
+{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
+
+=== Logins for different targets are independent
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code
+
+>>> cache_keys
+[
+  "a#device-code",
+  "b#device-code",
+  "[DATABRICKS_URL]",
+  "[DATABRICKS_URL]#device-code",
+  "test"
+]
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Profile b was successfully saved
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Profile a was successfully saved
+
+>>> cache_keys
+[
+  "a",
+  "b",
+  "[DATABRICKS_URL]",
+  "test"
+]
+
+>>> print_requests.py --oneline //oidc/v1/token
+{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-4&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
+{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-5&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
+{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-3&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/script b/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/script
new file mode 100644
index 00000000000..97ade6f94d2
--- /dev/null
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/script
@@ -0,0 +1,23 @@
+sethome "./home"
+
+# The real server issues a new user code for every login, while the fake server
+# issues the same one. The script gives the second login its own user code.
+title "A second login for the same profile replaces the first\n"
+start_login LOG.first $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code
+start_login LOG.second $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code
+trace update_file.py home/.databricks/token-cache.json WDJBMJHT NEWRCODE
+trace cache_keys
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code NEWR-CODE --confirmation-code FTFA-QQKY
+trace print_requests.py --oneline //oidc/v1/token
+
+title "Logins for different targets are independent\n"
+start_login LOG.a $CLI auth login --host $DATABRICKS_HOST --profile a --use-device-code
+start_login LOG.b $CLI auth login --host $DATABRICKS_HOST --profile b --use-device-code
+start_login LOG.host $CLI auth login --host $DATABRICKS_HOST --use-device-code
+trace cache_keys
+trace $CLI auth login --host $DATABRICKS_HOST --profile b --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace $CLI auth login --host $DATABRICKS_HOST --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace $CLI auth login --host $DATABRICKS_HOST --profile a --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace cache_keys
+trace print_requests.py --oneline //oidc/v1/token
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/errors/home/.databrickscfg.tmpl b/acceptance/cmd/auth/login/device-code/non-interactive/errors/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..3017709a305
--- /dev/null
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/errors/home/.databrickscfg.tmpl
@@ -0,0 +1,4 @@
+[resources]
+host      = $DATABRICKS_HOST
+resources = https://resource.test
+auth_type = databricks-cli
diff --git a/acceptance/cmd/auth/login/device-code/wrong-code/out.test.toml b/acceptance/cmd/auth/login/device-code/non-interactive/errors/out.test.toml
similarity index 100%
rename from acceptance/cmd/auth/login/device-code/wrong-code/out.test.toml
rename to acceptance/cmd/auth/login/device-code/non-interactive/errors/out.test.toml
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
new file mode 100644
index 00000000000..a71936588a9
--- /dev/null
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
@@ -0,0 +1,90 @@
+
+=== Device code login is disabled by default
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
+Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
+
+=== Flags the non-interactive login cannot honor
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --configure-cluster
+Error: --configure-cluster is not supported by the non-interactive device code login. Set cluster_id on the profile after the login
+
+=== Missing host
+
+>>> musterr [CLI] auth login --use-device-code
+Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
+
+>>> musterr [CLI] auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
+
+=== Incomplete flags of the second step
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --confirmation-code FTFA-QQKY
+Error: --confirmation-code requires --user-code
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT
+Error: --user-code requires --confirmation-code
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Error: --confirmation-code requires --use-device-code
+
+=== Account host
+
+>>> musterr [CLI] auth login --host https://accounts.cloud.databricks.test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Warn: [hostmetadata] failed to fetch host metadata for https://accounts.cloud.databricks.test, will skip for 1m0s
+Error: --use-device-code is only supported for workspace hosts
+
+=== Profile scoped to resources
+
+>>> musterr [CLI] auth login --profile resources --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Error: --use-device-code cannot be used with profile resources because its login is scoped to resources. Log in without --use-device-code
+
+=== No pending login
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Error: no pending device code login for profile test. Run the same command without --user-code and --confirmation-code to start a new login
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Error: no pending device code login for host [DATABRICKS_URL]. Run the same command without --user-code and --confirmation-code to start a new login
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
+
+=== Wrong confirmation code
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code AAAA-AAAA
+Error: token exchange: Invalid confirmation code (error code: invalid_request). Check the confirmation code and approve the login if you haven't, then rerun this command. Run the same command without --user-code and --confirmation-code to start a new login if it still fails
+
+=== Rerun with the right confirmation code
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code wdjb-mjht --confirmation-code ftfa-qqky
+Profile test was successfully saved
+
+=== Rerun after the login was completed
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Error: no pending device code login for profile test. Run the same command without --user-code and --confirmation-code to start a new login
+
+=== Device code unknown to the server
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
+
+>>> update_file.py home/.databricks/token-cache.json device-code-2 unknown-device-code
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Error: token exchange: Invalid device code (error code: invalid_request). Run the same command without --user-code and --confirmation-code to start a new login
+
+>>> cache_keys
+[
+  "[DATABRICKS_URL]",
+  "test"
+]
+
+>>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
+{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
+{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=AAAAAAAA&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
+{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
+{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
+{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=unknown-device-code&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/errors/script b/acceptance/cmd/auth/login/device-code/non-interactive/errors/script
new file mode 100644
index 00000000000..15a8010930f
--- /dev/null
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/errors/script
@@ -0,0 +1,56 @@
+sethome "./home"
+
+title "Device code login is disabled by default\n"
+(
+    unset DATABRICKS_CLI_DEVICE_CODE
+    trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code
+    trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+)
+
+title "Flags the non-interactive login cannot honor\n"
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --configure-cluster
+
+# The non-interactive login cannot answer the profile picker or the host prompt.
+title "Missing host\n"
+trace musterr $CLI auth login --use-device-code
+trace musterr $CLI auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+
+title "Incomplete flags of the second step\n"
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --confirmation-code FTFA-QQKY
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+
+title "Account host\n"
+trace musterr $CLI auth login --host https://accounts.cloud.databricks.test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
+
+title "Profile scoped to resources\n"
+trace musterr $CLI auth login --profile resources --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+
+title "No pending login\n"
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace musterr $CLI auth login --host $DATABRICKS_HOST --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+
+start_login LOG.wrong-code $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code
+
+title "Wrong confirmation code\n"
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code AAAA-AAAA
+
+# A wrong confirmation code leaves the device code valid, so the pending
+# login is kept.
+title "Rerun with the right confirmation code\n"
+trace $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code wdjb-mjht --confirmation-code ftfa-qqky
+
+title "Rerun after the login was completed\n"
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+
+# The server discards the device code when the login expires. The pending
+# login is then deleted.
+title "Device code unknown to the server\n"
+start_login LOG.expired $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code
+trace update_file.py home/.databricks/token-cache.json device-code-2 unknown-device-code
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace cache_keys
+
+trace print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/flags/home/.databrickscfg.tmpl b/acceptance/cmd/auth/login/device-code/non-interactive/flags/home/.databrickscfg.tmpl
new file mode 100644
index 00000000000..d8e7fb8ab03
--- /dev/null
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/flags/home/.databrickscfg.tmpl
@@ -0,0 +1,5 @@
+[scoped]
+host      = $DATABRICKS_HOST
+scopes    = sql
+client_id = databricks-cli
+auth_type = databricks-cli
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/flags/out.databrickscfg b/acceptance/cmd/auth/login/device-code/non-interactive/flags/out.databrickscfg
new file mode 100644
index 00000000000..18fafc1c622
--- /dev/null
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/flags/out.databrickscfg
@@ -0,0 +1,15 @@
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+
+[scoped]
+host         = [DATABRICKS_URL]
+scopes       = sql
+auth_type    = databricks-cli
+workspace_id = [WORKSPACE_ID]
+client_id    = databricks-cli
+
+[serverless]
+host                  = [DATABRICKS_URL]
+serverless_compute_id = auto
+workspace_id          = [WORKSPACE_ID]
+auth_type             = databricks-cli
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/flags/out.test.toml b/acceptance/cmd/auth/login/device-code/non-interactive/flags/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/flags/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/flags/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/flags/output.txt
new file mode 100644
index 00000000000..a39e6a70953
--- /dev/null
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/flags/output.txt
@@ -0,0 +1,36 @@
+
+=== Scopes and client ID from the profile
+
+>>> [CLI] auth login --profile scoped --use-device-code
+Using a browser on another device, visit:
+[DATABRICKS_URL]/device/verification
+
+And enter the code:
+WDJB-MJHT
+
+Once finished, complete the login by running the same command with
+--user-code WDJB-MJHT and --confirmation-code set to the confirmation code
+provided in your browser.
+
+>>> [CLI] auth login --profile scoped --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Profile scoped was successfully saved
+
+>>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
+{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+sql"}
+{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
+
+=== Serverless compute is configured in the second step
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile serverless --use-device-code --configure-serverless
+Using a browser on another device, visit:
+[DATABRICKS_URL]/device/verification
+
+And enter the code:
+WDJB-MJHT
+
+Once finished, complete the login by running the same command with
+--user-code WDJB-MJHT and --confirmation-code set to the confirmation code
+provided in your browser.
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile serverless --use-device-code --configure-serverless --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Profile serverless was successfully saved
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/flags/script b/acceptance/cmd/auth/login/device-code/non-interactive/flags/script
new file mode 100644
index 00000000000..4824729081c
--- /dev/null
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/flags/script
@@ -0,0 +1,16 @@
+sethome "./home"
+envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
+
+# The rerun resolves the login from the same flags and profile as the first
+# step, so the token exchange uses the client ID of the profile.
+title "Scopes and client ID from the profile\n"
+trace $CLI auth login --profile scoped --use-device-code
+trace $CLI auth login --profile scoped --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
+
+# Only the second step saves the profile.
+title "Serverless compute is configured in the second step\n"
+trace $CLI auth login --host $DATABRICKS_HOST --profile serverless --use-device-code --configure-serverless
+trace $CLI auth login --host $DATABRICKS_HOST --profile serverless --use-device-code --configure-serverless --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+
+mv "./home/.databrickscfg" "./out.databrickscfg"
diff --git a/acceptance/cmd/auth/login/device-code/nominal/out.databrickscfg b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/out.databrickscfg
similarity index 68%
rename from acceptance/cmd/auth/login/device-code/nominal/out.databrickscfg
rename to acceptance/cmd/auth/login/device-code/non-interactive/nominal/out.databrickscfg
index 02b3737c466..cf14685849c 100644
--- a/acceptance/cmd/auth/login/device-code/nominal/out.databrickscfg
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/out.databrickscfg
@@ -8,9 +8,3 @@ auth_type    = databricks-cli
 
 [__settings__]
 default_profile = test
-
-[scoped]
-host         = [DATABRICKS_URL]
-workspace_id = [WORKSPACE_ID]
-scopes       = sql
-auth_type    = databricks-cli
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/nominal/out.test.toml b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/login/device-code/nominal/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt
similarity index 52%
rename from acceptance/cmd/auth/login/device-code/nominal/output.txt
rename to acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt
index 2216533b304..5a70dc2fd0c 100644
--- a/acceptance/cmd/auth/login/device-code/nominal/output.txt
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt
@@ -1,5 +1,40 @@
 
-=== Login with a host
+=== Start the login without a profile
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code
+Using a browser on another device, visit:
+[DATABRICKS_URL]/device/verification
+
+And enter the code:
+WDJB-MJHT
+
+Once finished, complete the login by running the same command with
+--user-code WDJB-MJHT and --confirmation-code set to the confirmation code
+provided in your browser.
+
+=== The first step stores the device code and saves no profile
+
+>>> find.py home
+home/.databricks/token-cache.json
+
+>>> cache_keys
+[
+  "[DATABRICKS_URL]#device-code"
+]
+
+=== Confirm the login
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+
+>>> [CLI] auth token --host [DATABRICKS_URL]
+json.access_token = "oauth-token";
+
+>>> cache_keys
+[
+  "[DATABRICKS_URL]"
+]
+
+=== Start the login with a profile
 
 >>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
 Using a browser on another device, visit:
@@ -8,8 +43,14 @@ Using a browser on another device, visit:
 And enter the code:
 WDJB-MJHT
 
-Once finished, enter the confirmation code provided in your browser.
-Confirmation code: Profile test was successfully saved
+Once finished, complete the login by running the same command with
+--user-code WDJB-MJHT and --confirmation-code set to the confirmation code
+provided in your browser.
+
+=== Confirm the login
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Profile test was successfully saved
 
 >>> [CLI] auth token --profile test
 json.access_token = "oauth-token";
@@ -18,7 +59,7 @@ json.access_token = "oauth-token";
 Name            Host                    Valid
 test (Default)  [DATABRICKS_URL]  YES
 
-=== Login again with the host from the saved profile
+=== Start the login again with the host from the saved profile
 
 >>> [CLI] auth login --profile test --use-device-code
 Using a browser on another device, visit:
@@ -27,30 +68,26 @@ Using a browser on another device, visit:
 And enter the code:
 WDJB-MJHT
 
-Once finished, enter the confirmation code provided in your browser.
-Confirmation code: Profile test was successfully saved
+Once finished, complete the login by running the same command with
+--user-code WDJB-MJHT and --confirmation-code set to the confirmation code
+provided in your browser.
 
 >>> [CLI] auth token --profile test
 json.access_token = "oauth-token";
 
+>>> [CLI] auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Profile test was successfully saved
+
+>>> cache_keys
+[
+  "[DATABRICKS_URL]",
+  "test"
+]
+
 >>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
 {"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
 {"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
 {"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
 {"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
-
-=== Login with custom scopes
-
->>> [CLI] auth login --host [DATABRICKS_URL] --profile scoped --use-device-code --scopes sql
-Using a browser on another device, visit:
-[DATABRICKS_URL]/device/verification
-
-And enter the code:
-WDJB-MJHT
-
-Once finished, enter the confirmation code provided in your browser.
-Confirmation code: Profile scoped was successfully saved
-
->>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
-{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+sql"}
+{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
 {"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-3&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/nominal/script b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/script
new file mode 100644
index 00000000000..2f00d282b27
--- /dev/null
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/script
@@ -0,0 +1,35 @@
+sethome "./home"
+
+# Acceptance tests run the CLI without a terminal on stdin, so device code
+# login runs non-interactively.
+title "Start the login without a profile\n"
+trace $CLI auth login --host $DATABRICKS_HOST --use-device-code
+
+title "The first step stores the device code and saves no profile\n"
+trace find.py home
+trace cache_keys
+
+title "Confirm the login\n"
+trace $CLI auth login --host $DATABRICKS_HOST --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace $CLI auth token --host $DATABRICKS_HOST | gron.py | grep access_token
+trace cache_keys
+
+title "Start the login with a profile\n"
+trace $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code
+
+title "Confirm the login\n"
+trace $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace $CLI auth token --profile test | gron.py | grep access_token
+trace $CLI auth profiles
+
+# The pending login is stored next to the token, so the token keeps working
+# until the login is confirmed.
+title "Start the login again with the host from the saved profile\n"
+trace $CLI auth login --profile test --use-device-code
+trace $CLI auth token --profile test | gron.py | grep access_token
+trace $CLI auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace cache_keys
+trace print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
+
+# Track the .databrickscfg file that was created to surface changes.
+mv "./home/.databrickscfg" "./out.databrickscfg"
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/script.prepare b/acceptance/cmd/auth/login/device-code/non-interactive/script.prepare
new file mode 100644
index 00000000000..447c920c748
--- /dev/null
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/script.prepare
@@ -0,0 +1,13 @@
+# cache_keys lists the keys in the plaintext token cache.
+cache_keys() {
+    jq -S '.tokens | keys' "./home/.databricks/token-cache.json"
+}
+
+# start_login traces the first step in "$@" and saves its output to file $1,
+# for steps whose output was already shown.
+start_login() {
+    local log="$1"
+    shift
+    >&2 printf "\n>>> %s\n" "$*"
+    "$@" &> "$log"
+}
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/test.toml b/acceptance/cmd/auth/login/device-code/non-interactive/test.toml
new file mode 100644
index 00000000000..f493574d1e4
--- /dev/null
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/test.toml
@@ -0,0 +1,3 @@
+# A dedicated server issues device codes in a known order, so that the scripts
+# can confirm them.
+RecordRequests = true
diff --git a/acceptance/cmd/auth/login/device-code/unsupported-host/output.txt b/acceptance/cmd/auth/login/device-code/unsupported-host/output.txt
index 7875f49ed6b..5d327ce2db2 100644
--- a/acceptance/cmd/auth/login/device-code/unsupported-host/output.txt
+++ b/acceptance/cmd/auth/login/device-code/unsupported-host/output.txt
@@ -2,7 +2,7 @@
 === No host
 
 >>> musterr [CLI] auth login --profile new-profile --use-device-code
-Error: the command is being run in a non-interactive environment, please specify a host using --host
+Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
 
 === Account host
 
diff --git a/acceptance/cmd/auth/login/device-code/unsupported-host/script b/acceptance/cmd/auth/login/device-code/unsupported-host/script
index d744aec1709..2d0a8949c8e 100644
--- a/acceptance/cmd/auth/login/device-code/unsupported-host/script
+++ b/acceptance/cmd/auth/login/device-code/unsupported-host/script
@@ -4,7 +4,7 @@ title "No host\n"
 # The profile does not exist yet and no host is given. auth login does not read
 # DATABRICKS_HOST, so the usual login would fall back to the browser-based
 # discovery flow. Device code login skips it and asks for the host instead,
-# which fails without a terminal.
+# which the non-interactive login cannot do.
 trace musterr $CLI auth login --profile new-profile --use-device-code
 
 envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
diff --git a/acceptance/cmd/auth/login/device-code/wrong-code/output.txt b/acceptance/cmd/auth/login/device-code/wrong-code/output.txt
deleted file mode 100644
index 2ba7f3ea23e..00000000000
--- a/acceptance/cmd/auth/login/device-code/wrong-code/output.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-
-=== Login fails when no confirmation code is provided
-
->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
-Using a browser on another device, visit:
-[DATABRICKS_URL]/device/verification
-
-And enter the code:
-WDJB-MJHT
-
-Once finished, enter the confirmation code provided in your browser.
-Confirmation code: Error: reading confirmation code: EOF
-
-=== Login fails after 3 wrong confirmation codes
-
->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
-Using a browser on another device, visit:
-[DATABRICKS_URL]/device/verification
-
-And enter the code:
-WDJB-MJHT
-
-Once finished, enter the confirmation code provided in your browser.
-Confirmation code: Invalid confirmation code (error code: invalid_request). Enter the confirmation code again (2 attempts left).
-Confirmation code: Invalid confirmation code (error code: invalid_request). Enter the confirmation code again (1 attempt left).
-Confirmation code: Error: Invalid confirmation code (error code: invalid_request). Start login from scratch
-
-=== Login succeeds after re-entering the confirmation code
-
->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
-Using a browser on another device, visit:
-[DATABRICKS_URL]/device/verification
-
-And enter the code:
-WDJB-MJHT
-
-Once finished, enter the confirmation code provided in your browser.
-Confirmation code: Invalid confirmation code (error code: invalid_request). Enter the confirmation code again (2 attempts left).
-Confirmation code: Invalid confirmation code (error code: invalid_request). Enter the confirmation code again (1 attempt left).
-Confirmation code: Profile test was successfully saved
diff --git a/acceptance/cmd/auth/login/device-code/wrong-code/script b/acceptance/cmd/auth/login/device-code/wrong-code/script
deleted file mode 100644
index 3adb0de81a3..00000000000
--- a/acceptance/cmd/auth/login/device-code/wrong-code/script
+++ /dev/null
@@ -1,13 +0,0 @@
-sethome "./home"
-
-title "Login fails when no confirmation code is provided\n"
-trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code < /dev/null
-
-title "Login fails after 3 wrong confirmation codes\n"
-printf "AAAA-AAAA\nBBBB-BBBB\nCCCC-CCCC\n" | trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code
-
-# A wrong confirmation code leaves the device code valid, so the user can
-# enter it again. A blank line counts as a wrong confirmation code.
-# The confirmation code is accepted the way the browser displays it, in any case.
-title "Login succeeds after re-entering the confirmation code\n"
-printf "AAAA-AAAA\n\nftfa-qqky\n" | trace $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code
diff --git a/acceptance/cmd/auth/logout/pending-device-code-login/out.test.toml b/acceptance/cmd/auth/logout/pending-device-code-login/out.test.toml
new file mode 100644
index 00000000000..18b1a88417e
--- /dev/null
+++ b/acceptance/cmd/auth/logout/pending-device-code-login/out.test.toml
@@ -0,0 +1 @@
+Cloud = false
diff --git a/acceptance/cmd/auth/logout/pending-device-code-login/output.txt b/acceptance/cmd/auth/logout/pending-device-code-login/output.txt
new file mode 100644
index 00000000000..b347f1321d4
--- /dev/null
+++ b/acceptance/cmd/auth/logout/pending-device-code-login/output.txt
@@ -0,0 +1,19 @@
+
+=== Logout and delete dev
+>>> [CLI] auth logout --profile dev --auto-approve --delete
+Logged out of and deleted profile "dev".
+
+=== Token cache keys after logout — the host keys are kept, staging shares them
+[
+  "[DATABRICKS_URL]",
+  "[DATABRICKS_URL]#device-code",
+  "staging",
+  "staging#device-code"
+]
+
+=== Logout staging
+>>> [CLI] auth logout --profile staging --auto-approve
+Logged out of profile "staging". Use --delete to also remove it from the config file.
+
+=== Token cache keys after logout — no profile uses the host anymore
+[]
diff --git a/acceptance/cmd/auth/logout/pending-device-code-login/script b/acceptance/cmd/auth/logout/pending-device-code-login/script
new file mode 100644
index 00000000000..1d62f2cb572
--- /dev/null
+++ b/acceptance/cmd/auth/logout/pending-device-code-login/script
@@ -0,0 +1,38 @@
+sethome "./home"
+
+cat > "./home/.databrickscfg" <<EOF
+[dev]
+host = ${DATABRICKS_HOST}
+auth_type  = databricks-cli
+
+[staging]
+host = ${DATABRICKS_HOST}
+auth_type  = databricks-cli
+EOF
+
+mkdir -p "./home/.databricks"
+cat > "./home/.databricks/token-cache.json" <<EOF
+{
+  "version": 1,
+  "tokens": {
+    "dev": {"access_token": "dev-cached-token", "token_type": "Bearer"},
+    "dev#device-code": {"pending_login": {"device_code": "dev-device-code", "user_code": "WDJBMJHT"}},
+    "staging": {"access_token": "staging-cached-token", "token_type": "Bearer"},
+    "staging#device-code": {"pending_login": {"device_code": "staging-device-code", "user_code": "WDJBMJHT"}},
+    "${DATABRICKS_HOST}": {"access_token": "shared-host-token", "token_type": "Bearer"},
+    "${DATABRICKS_HOST}#device-code": {"pending_login": {"device_code": "host-device-code", "user_code": "WDJBMJHT"}}
+  }
+}
+EOF
+
+title "Logout and delete dev"
+trace $CLI auth logout --profile dev --auto-approve --delete
+
+title "Token cache keys after logout — the host keys are kept, staging shares them\n"
+jq -S '.tokens | keys' "./home/.databricks/token-cache.json"
+
+title "Logout staging"
+trace $CLI auth logout --profile staging --auto-approve
+
+title "Token cache keys after logout — no profile uses the host anymore\n"
+jq -S '.tokens | keys' "./home/.databricks/token-cache.json"
diff --git a/cmd/auth/README.md b/cmd/auth/README.md
index 11d43bc14c4..2b227825b77 100644
--- a/cmd/auth/README.md
+++ b/cmd/auth/README.md
@@ -104,3 +104,37 @@ Notes on the server behavior the CLI relies on:
 - The refresh token is single-use (rotating) and has an absolute lifetime of
   24 hours by default. After that, `databricks auth token` fails with a
   refresh error and the user needs to log in again.
+
+## Non-interactive login
+
+Device code login reads the confirmation code from stdin. When stdin is not a
+terminal (`cmdio.IsInputTTY`), for example when an AI agent runs one-off shell
+commands, nobody can type the code in, and `auth login --use-device-code` runs
+in two steps instead:
+
+1. `auth login --use-device-code` requests the device authorization, stores
+   the device code as a pending login in the token store, and prints the
+   verification URI and the user code. It skips the prompts and saves no
+   profile.
+2. The same command with the hidden `--user-code` and `--confirmation-code`
+   flags exchanges the pending device code instead of requesting a new one,
+   and the rest of the login runs as usual.
+
+The pending login is a token store entry with `PendingLogin` set instead of a
+token. Its key is the login's cache key (the profile name, or the host without
+a profile) with a `#device-code` suffix, so the target's current token keeps
+working until the login completes. The device code never leaves the machine;
+only the user code and the confirmation code are printed or passed on the
+command line, and the confirmation code is useless without the device code.
+This keeps the confirmation code's protection against phishing: a code read
+from, e.g., an agent's transcript cannot complete the login on another machine.
+
+Each target has one pending login, and a new login for it replaces the old
+one. The second step checks the user code, so a replaced login fails with a
+clear error without sending its confirmation code. A wrong confirmation code
+keeps the pending login for a rerun. A successful exchange, or a device code
+the server no longer knows, deletes it. The CLI does not expire pending logins
+itself: the server does. `auth logout` deletes the pending login of the profile,
+and the one of its host when it deletes the host's token. A pending login for a
+profile that was never saved, or for a host that no profile uses, stays until a
+new login for it replaces it.
diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index abbfeeeb81b..cfbfe03eecd 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -182,6 +182,8 @@ a new profile is created.
 	var clientID string
 	var resources []string
 	var useDeviceCode bool
+	var userCode string
+	var confirmationCode string
 	cmd.Flags().DurationVar(&loginTimeout, "timeout", defaultTimeout,
 		"Timeout for completing login challenge in the browser")
 	cmd.Flags().BoolVar(&configureCluster, "configure-cluster", false,
@@ -200,6 +202,15 @@ a new profile is created.
 		"Log in with a device code, using a browser on another device (experimental)")
 	// Hidden while device code login is experimental.
 	cmd.Flags().MarkHidden("use-device-code")
+	// The non-interactive device code login tells the user to rerun the
+	// command with these flags, which completes the login. Hidden because only
+	// that rerun uses them.
+	cmd.Flags().StringVar(&userCode, "user-code", "",
+		"User code of the device code login to complete")
+	cmd.Flags().StringVar(&confirmationCode, "confirmation-code", "",
+		"Confirmation code that completes a device code login")
+	cmd.Flags().MarkHidden("user-code")
+	cmd.Flags().MarkHidden("confirmation-code")
 
 	cmd.PreRunE = profileHostConflictCheck
 
@@ -232,10 +243,24 @@ a new profile is created.
 			}
 		}
 
+		completeLogin := cmd.Flags().Changed("confirmation-code")
+		if err := validateDeviceCodeCompletionFlags(useDeviceCode, cmd.Flags().Changed("user-code"), completeLogin); err != nil {
+			return err
+		}
+		// Device code login reads the confirmation code from stdin. When stdin
+		// is not a terminal, e.g. when an AI agent runs the login as a one-off
+		// command, nobody can type the code in. The non-interactive login then
+		// stores the device code, and a rerun of the command with --user-code
+		// and --confirmation-code completes the login. Neither step prompts.
+		var nonInteractive bool
 		if useDeviceCode {
 			if err := validateDeviceCodeLogin(ctx, cmd); err != nil {
 				return err
 			}
+			nonInteractive = completeLogin || !cmdio.IsInputTTY(ctx)
+			if nonInteractive && configureCluster {
+				return errDeviceCodeNonInteractiveCluster
+			}
 		}
 
 		// Resolve the cache before the browser step so an unavailable
@@ -256,7 +281,7 @@ a new profile is created.
 		// discovery, so its "Create a new profile" asks for the host after the
 		// profile name.
 		var takenProfileNames []string
-		if profileName == "" && authArguments.Host == "" && len(args) == 0 && cmdio.IsPromptSupported(ctx) {
+		if profileName == "" && authArguments.Host == "" && len(args) == 0 && cmdio.IsPromptSupported(ctx) && !nonInteractive {
 			matchProfiles := profile.MatchAllProfiles
 			if useDeviceCode {
 				matchProfiles = matchDeviceCodeProfiles
@@ -321,8 +346,9 @@ a new profile is created.
 			runHostDiscovery(ctx, authArguments)
 		}
 
-		// If the user has not specified a profile name, prompt for one.
-		if profileName == "" {
+		// If the user has not specified a profile name, prompt for one. Without
+		// a profile, the non-interactive login stores the token under the host.
+		if profileName == "" && !nonInteractive {
 			var err error
 			profileName = getProfileName(authArguments)
 			if profileName == "" {
@@ -351,6 +377,11 @@ a new profile is created.
 			}
 		}
 
+		// The non-interactive login cannot answer the host prompt of setHost.
+		if nonInteractive && shouldUseDiscovery(authArguments.Host, args, existingProfile) {
+			return errDeviceCodeNeedsHost
+		}
+
 		// If no host is available from any source, use the discovery flow
 		// via login.databricks.com. Discovery opens a browser on this machine,
 		// and device code login is meant for machines without one, so it skips
@@ -434,10 +465,22 @@ a new profile is created.
 		}
 		defer persistentAuth.Close()
 
+		nonInteractiveLogin := nonInteractiveDeviceCodeLogin{
+			persistentAuth: persistentAuth,
+			tokenStore:     tokenStore,
+			key:            pendingLoginKey(oauthArgument.GetCacheKey()),
+			profile:        profileName,
+			host:           authArguments.Host,
+		}
 		var token *oauth2.Token
-		if useDeviceCode {
+		switch {
+		case completeLogin:
+			token, err = nonInteractiveLogin.complete(ctx, userCode, confirmationCode)
+		case nonInteractive:
+			return nonInteractiveLogin.start(ctx)
+		case useDeviceCode:
 			token, err = deviceCodeLogin(ctx, persistentAuth)
-		} else {
+		default:
 			token, err = persistentAuth.Challenge()
 		}
 		if err != nil {
diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index e960c6dd2b9..d1e6513310d 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -6,10 +6,12 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/databricks/cli/libs/auth/storage"
 	"github.com/databricks/cli/libs/auth/u2m"
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/databrickscfg/profile"
 	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
 	"github.com/spf13/cobra"
 	"golang.org/x/oauth2"
 )
@@ -18,6 +20,15 @@ import (
 // for a single device code before the login fails.
 const maxConfirmationAttempts = 3
 
+// pendingLoginKeySuffix marks the token store entry that holds a
+// non-interactive device code login until it completes. The entry sits next to
+// the login's token, so that a token that still works is kept until then.
+const pendingLoginKeySuffix = "#device-code"
+
+// startNewLoginHint ends the errors of a non-interactive device code login
+// that cannot be completed.
+const startNewLoginHint = "Run the same command without --user-code and --confirmation-code to start a new login"
+
 // deviceCodeIncompatibleFlags lists flags that device code login cannot honor.
 var deviceCodeIncompatibleFlags = []string{
 	// Resource indicators are sent on the browser authorization request,
@@ -30,6 +41,8 @@ var deviceCodeIncompatibleFlags = []string{
 var (
 	errDeviceCodeNeedsHost     = errors.New("--use-device-code requires a workspace host. Pass it as an argument or with --host")
 	errDeviceCodeWorkspaceOnly = errors.New("--use-device-code is only supported for workspace hosts")
+	// The cluster picker is interactive.
+	errDeviceCodeNonInteractiveCluster = errors.New("--configure-cluster is not supported by the non-interactive device code login. Set cluster_id on the profile after the login")
 )
 
 // isDeviceCodeSupportedForHost reports whether host is a workspace host. A
@@ -97,6 +110,131 @@ func deviceCodeLogin(ctx context.Context, persistentAuth *u2m.PersistentAuth) (*
 	return nil, fmt.Errorf("%w. Start login from scratch", lastErr)
 }
 
+// validateDeviceCodeCompletionFlags returns an error if the flags that complete
+// a non-interactive device code login are not set together.
+func validateDeviceCodeCompletionFlags(useDeviceCode, hasUserCode, hasConfirmationCode bool) error {
+	switch {
+	case hasConfirmationCode && !hasUserCode:
+		return errors.New("--confirmation-code requires --user-code")
+	case hasUserCode && !hasConfirmationCode:
+		return errors.New("--user-code requires --confirmation-code")
+	case hasConfirmationCode && !useDeviceCode:
+		return errors.New("--confirmation-code requires --use-device-code")
+	}
+	return nil
+}
+
+// nonInteractiveDeviceCodeLogin runs the two steps of a device code login
+// that cannot read the confirmation code from stdin. The first step stores the
+// device code as a pending login under key, and the second step exchanges it,
+// so that the device code never leaves the machine.
+type nonInteractiveDeviceCodeLogin struct {
+	persistentAuth *u2m.PersistentAuth
+	tokenStore     storage.Store
+	key            string
+	profile        string
+	host           string
+}
+
+// pendingLoginKey returns the token store key of the pending login for the
+// login with cacheKey.
+func pendingLoginKey(cacheKey string) string {
+	return cacheKey + pendingLoginKeySuffix
+}
+
+// target describes the login in errors.
+func (l nonInteractiveDeviceCodeLogin) target() string {
+	if l.profile != "" {
+		return "profile " + l.profile
+	}
+	return "host " + l.host
+}
+
+// start requests a device authorization, stores it as the pending login, and
+// prints how to complete the login. A pending login under the same key is
+// replaced.
+func (l nonInteractiveDeviceCodeLogin) start(ctx context.Context) error {
+	login, err := l.persistentAuth.NewDeviceCodeLogin()
+	if err != nil {
+		return err
+	}
+	da, err := login.RequestDeviceAuthorization(ctx)
+	if err != nil {
+		return err
+	}
+	err = l.tokenStore.Put(l.key, storage.Entry{PendingLogin: &storage.PendingLogin{
+		DeviceCode: da.DeviceCode,
+		UserCode:   da.UserCode,
+	}})
+	if err != nil {
+		return fmt.Errorf("store pending login: %w", err)
+	}
+	cmdio.LogString(ctx, strings.Join([]string{
+		"Using a browser on another device, visit:",
+		da.VerificationURI,
+		"",
+		"And enter the code:",
+		formatCode(da.UserCode),
+		"",
+		"Once finished, complete the login by running the same command with",
+		"--user-code " + formatCode(da.UserCode) + " and --confirmation-code set to the confirmation code",
+		"provided in your browser.",
+	}, "\n"))
+	return nil
+}
+
+// complete exchanges the device code of the pending login started with
+// userCode together with confirmationCode for a token.
+func (l nonInteractiveDeviceCodeLogin) complete(ctx context.Context, userCode, confirmationCode string) (*oauth2.Token, error) {
+	e, err := l.tokenStore.Lookup(l.key)
+	if err != nil && !errors.Is(err, storage.ErrNotFound) {
+		return nil, fmt.Errorf("read pending login: %w", err)
+	}
+	// The key can also hold the token of a profile that happens to be named
+	// like a pending login key.
+	pending := e.PendingLogin
+	if pending == nil {
+		return nil, fmt.Errorf("no pending device code login for %s. %s", l.target(), startNewLoginHint)
+	}
+	// Each profile or host has one pending login, so a newer login replaces
+	// it. Checking the user code here avoids sending the confirmation code
+	// with the wrong device code, which the server would reject as a wrong
+	// confirmation code.
+	if !sameCode(pending.UserCode, userCode) {
+		return nil, fmt.Errorf("a newer login for %s replaced this one. Complete the newer login with its user code. %s", l.target(), startNewLoginHint)
+	}
+
+	login, err := l.persistentAuth.NewDeviceCodeLogin()
+	if err != nil {
+		return nil, err
+	}
+	token, err := login.RequestDeviceAccessToken(ctx, pending.DeviceCode, confirmationCode)
+	if err != nil {
+		err = fmt.Errorf("token exchange: %w", err)
+	}
+	// A wrong confirmation code leaves the device code valid, so the pending
+	// login is kept for a rerun. Otherwise the server no longer accepts the
+	// device code.
+	if err == nil || errors.Is(err, u2m.ErrInvalidDeviceCode) {
+		if err := l.tokenStore.Delete(l.key); err != nil {
+			log.Debugf(ctx, "Failed to delete the pending device code login: %v", err)
+		}
+	}
+	switch {
+	case errors.Is(err, u2m.ErrInvalidConfirmationCode):
+		return nil, fmt.Errorf("%w. Check the confirmation code and approve the login if you haven't, then rerun this command. %s if it still fails", err, startNewLoginHint)
+	case errors.Is(err, u2m.ErrInvalidDeviceCode):
+		return nil, fmt.Errorf("%w. %s", err, startNewLoginHint)
+	}
+	return token, err
+}
+
+// sameCode reports whether two device codes match when compared the way the
+// user enters them.
+func sameCode(a, b string) bool {
+	return u2m.NormalizeCode(a) == u2m.NormalizeCode(b)
+}
+
 // promptForConfirmationCode shows the user where to approve the login and
 // reads the confirmation code from stdin. If the server rejected the previous
 // code, it shows the server's error and the number of attempts left instead
diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index 5fbb18c1a18..85f0db7ced0 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -3,15 +3,21 @@ package auth
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"errors"
 	"io"
 	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
 	"runtime"
+	"strconv"
 	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
 
+	"github.com/databricks/cli/internal/testutil"
 	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/auth/u2m"
 	"github.com/databricks/cli/libs/cmdio"
@@ -211,32 +217,59 @@ func TestIsDeviceCodeSupportedForHost(t *testing.T) {
 	}
 }
 
-// startLogin runs "auth login" with args in a terminal emulator, using config
-// as the contents of .databrickscfg.
-func startLogin(t *testing.T, config string, args ...string) *termtest.Term[struct{}] {
+// setUpLogin isolates the environment of a login, using config as the contents
+// of .databrickscfg.
+func setUpLogin(t *testing.T, config string) {
+	testutil.CleanupEnvironment(t)
 	home := t.TempDir()
 	t.Setenv("HOME", home)
 	t.Setenv("USERPROFILE", home)
 	t.Setenv("DATABRICKS_CONFIG_FILE", writeTempConfig(t, config))
 	t.Setenv("DATABRICKS_AUTH_STORAGE", "plaintext")
+}
 
+// runLogin runs "auth login" with args.
+func runLogin(ctx context.Context, args ...string) error {
+	authArguments := &auth.AuthArguments{}
+	cmd := newLoginCommand(authArguments)
+	cmd.Flags().StringVar(&authArguments.Host, "host", "", "")
+	cmd.Flags().String("profile", "", "")
+	cmd.SetContext(ctx)
+	// Cobra reads os.Args when the args are nil.
+	cmd.SetArgs(append([]string{}, args...))
+	cmd.SetOut(io.Discard)
+	cmd.SetErr(io.Discard)
+	return cmd.Execute()
+}
+
+// startLogin runs "auth login" with args in a terminal emulator, using config
+// as the contents of .databrickscfg.
+func startLogin(t *testing.T, config string, args ...string) *termtest.Term[struct{}] {
+	setUpLogin(t, config)
 	return termtest.Run(t, func(ctx context.Context) (struct{}, error) {
-		cmd := newLoginCommand(&auth.AuthArguments{})
-		cmd.Flags().String("profile", "", "")
-		cmd.SetContext(ctx)
-		// Cobra reads os.Args when the args are nil.
-		cmd.SetArgs(append([]string{}, args...))
-		cmd.SetOut(io.Discard)
-		cmd.SetErr(io.Discard)
-		return struct{}{}, cmd.Execute()
+		return struct{}{}, runLogin(ctx, args...)
 	})
 }
 
+// setUpDeviceCodeLogin isolates the environment of a device code login, using
+// config as the contents of .databrickscfg.
+func setUpDeviceCodeLogin(t *testing.T, config string) {
+	setUpLogin(t, config)
+	t.Setenv(deviceCodeEnvVar, "true")
+}
+
+// runDeviceCodeLogin runs "auth login --use-device-code" with args.
+func runDeviceCodeLogin(ctx context.Context, args ...string) error {
+	return runLogin(ctx, append([]string{"--use-device-code"}, args...)...)
+}
+
 // startDeviceCodeLogin runs "auth login --use-device-code" with args in a
 // terminal emulator, using config as the contents of .databrickscfg.
 func startDeviceCodeLogin(t *testing.T, config string, args ...string) *termtest.Term[struct{}] {
-	t.Setenv(deviceCodeEnvVar, "true")
-	return startLogin(t, config, append([]string{"--use-device-code"}, args...)...)
+	setUpDeviceCodeLogin(t, config)
+	return termtest.Run(t, func(ctx context.Context) (struct{}, error) {
+		return struct{}{}, runDeviceCodeLogin(ctx, args...)
+	})
 }
 
 func TestLoginDeviceCodeNewProfilePromptsForHost(t *testing.T) {
@@ -338,6 +371,157 @@ resources = https://workspace.test/ai-gateway/mcp-services/system.ai.github
 	assert.EqualError(t, err, "^C")
 }
 
+func TestValidateDeviceCodeCompletionFlags(t *testing.T) {
+	tests := []struct {
+		name                string
+		useDeviceCode       bool
+		hasUserCode         bool
+		hasConfirmationCode bool
+		wantErr             string
+	}{
+		{name: "neither", useDeviceCode: true},
+		{name: "both", useDeviceCode: true, hasUserCode: true, hasConfirmationCode: true},
+		{name: "confirmation code only", useDeviceCode: true, hasConfirmationCode: true, wantErr: "--confirmation-code requires --user-code"},
+		{name: "user code only", useDeviceCode: true, hasUserCode: true, wantErr: "--user-code requires --confirmation-code"},
+		{name: "without device code", hasUserCode: true, hasConfirmationCode: true, wantErr: "--confirmation-code requires --use-device-code"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateDeviceCodeCompletionFlags(tt.useDeviceCode, tt.hasUserCode, tt.hasConfirmationCode)
+			if tt.wantErr != "" {
+				assert.EqualError(t, err, tt.wantErr)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestSameCode(t *testing.T) {
+	assert.True(t, sameCode("WDJBMJHT", "WDJB-MJHT"))
+	assert.True(t, sameCode("WDJBMJHT", "wdjbmjht"))
+	assert.True(t, sameCode("WDJBMJHT", " WDJB-MJHT\n"))
+	assert.False(t, sameCode("WDJBMJHT", "WDJB-MJHA"))
+}
+
+// newDeviceCodeServer returns a fake workspace with device code login.
+func newDeviceCodeServer(t *testing.T) *testserver.Server {
+	server := testserver.New(t)
+	testserver.AddDefaultHandlers(server)
+	return server
+}
+
+// A wrong or blank confirmation code leaves the device code valid, so the user
+// can enter it again. The code is accepted the way the browser displays it, in
+// any case.
+func TestLoginDeviceCodeReadsConfirmationCode(t *testing.T) {
+	server := newDeviceCodeServer(t)
+	tm := startDeviceCodeLogin(t, "[test]\nhost = "+server.URL+"\n", "--profile", "test")
+	tm.WaitFor("Confirmation code")
+	tm.Type("AAAA-AAAA\n")
+	tm.WaitFor("Enter the confirmation code again (2 attempts left)")
+	tm.Type("\n")
+	tm.WaitFor("Enter the confirmation code again (1 attempt left)")
+	tm.Type("ftfa-qqky\n")
+	_, err := tm.Result()
+	require.NoError(t, err)
+
+	p, err := loadProfileByName(t.Context(), "test", profile.DefaultProfiler)
+	require.NoError(t, err)
+	require.NotNil(t, p)
+	assert.Equal(t, server.URL, p.Host)
+	assert.Equal(t, strconv.Itoa(testserver.TestWorkspaceID), p.WorkspaceID)
+	assert.Equal(t, authTypeDatabricksCLI, p.AuthType)
+
+	raw, err := os.ReadFile(filepath.Join(os.Getenv("HOME"), ".databricks", "token-cache.json"))
+	require.NoError(t, err)
+	var cache struct {
+		Tokens map[string]json.RawMessage `json:"tokens"`
+	}
+	require.NoError(t, json.Unmarshal(raw, &cache))
+	assert.Contains(t, cache.Tokens, "test")
+}
+
+func TestLoginDeviceCodeFailsAfterWrongConfirmationCodes(t *testing.T) {
+	server := newDeviceCodeServer(t)
+	tm := startDeviceCodeLogin(t, "[test]\nhost = "+server.URL+"\n", "--profile", "test")
+	tm.WaitFor("Confirmation code")
+	tm.Type("AAAA-AAAA\nBBBB-BBBB\nCCCC-CCCC\n")
+	_, err := tm.Result()
+	assert.EqualError(t, err, "Invalid confirmation code (error code: invalid_request). Start login from scratch")
+}
+
+func TestLoginDeviceCodeFailsWithoutConfirmationCode(t *testing.T) {
+	server := newDeviceCodeServer(t)
+	tm := startDeviceCodeLogin(t, "[test]\nhost = "+server.URL+"\n", "--profile", "test")
+	tm.WaitFor("Confirmation code")
+	tm.Close()
+	_, err := tm.Result()
+	assert.EqualError(t, err, "reading confirmation code: EOF")
+}
+
+// The token gets the scopes requested at device authorization, so --scopes is
+// sent there and not with the token request.
+func TestLoginDeviceCodeRequestsScopes(t *testing.T) {
+	server := newDeviceCodeServer(t)
+	var scope string
+	server.RequestCallback = func(r *testserver.Request) {
+		if r.URL.Path == "/oidc/v1/device/auth" {
+			form, err := url.ParseQuery(string(r.Body))
+			assert.NoError(t, err)
+			scope = form.Get("scope")
+		}
+	}
+	tm := startDeviceCodeLogin(t, "", "--host", server.URL, "--profile", "test", "--scopes", "sql")
+	tm.WaitFor("Confirmation code")
+	tm.Type("FTFA-QQKY\n")
+	_, err := tm.Result()
+	require.NoError(t, err)
+	assert.Equal(t, "offline_access sql", scope)
+
+	p, err := loadProfileByName(t.Context(), "test", profile.DefaultProfiler)
+	require.NoError(t, err)
+	require.NotNil(t, p)
+	assert.Equal(t, server.URL, p.Host)
+	assert.Equal(t, strconv.Itoa(testserver.TestWorkspaceID), p.WorkspaceID)
+	assert.Equal(t, "sql", p.Scopes)
+}
+
+// An agent without a terminal can start the login, and the user can complete
+// it in a terminal. The second step does not prompt for a profile, so it finds
+// the pending login under the host, like the first step did.
+func TestLoginDeviceCodeCompletesInTerminal(t *testing.T) {
+	server := newDeviceCodeServer(t)
+	setUpDeviceCodeLogin(t, "")
+	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), flags.OutputText, strings.NewReader(""), &bytes.Buffer{}, &bytes.Buffer{}, "", ""))
+	require.NoError(t, runDeviceCodeLogin(ctx, "--host", server.URL))
+
+	tm := termtest.Run(t, func(ctx context.Context) (struct{}, error) {
+		return struct{}{}, runDeviceCodeLogin(ctx, "--host", server.URL, "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY")
+	})
+	_, err := tm.Result()
+	require.NoError(t, err)
+
+	raw, err := os.ReadFile(filepath.Join(os.Getenv("HOME"), ".databricks", "token-cache.json"))
+	require.NoError(t, err)
+	var cache struct {
+		Tokens map[string]json.RawMessage `json:"tokens"`
+	}
+	require.NoError(t, json.Unmarshal(raw, &cache))
+	assert.Contains(t, cache.Tokens, server.URL)
+	assert.NotContains(t, cache.Tokens, pendingLoginKey(server.URL))
+
+	profiles, err := profile.DefaultProfiler.LoadProfiles(t.Context(), profile.MatchAllProfiles)
+	require.NoError(t, err)
+	assert.Empty(t, profiles)
+}
+
+func TestLoginDeviceCodeCompletionWithoutHostSkipsPicker(t *testing.T) {
+	tm := startDeviceCodeLogin(t, "", "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY")
+	_, err := tm.Result()
+	assert.ErrorIs(t, err, errDeviceCodeNeedsHost)
+}
+
 // Only a wrong confirmation code can be fixed by entering the code again, so
 // any other token exchange error ends the login.
 func TestLoginDeviceCodeFailsOnTokenExchangeError(t *testing.T) {
diff --git a/cmd/auth/logout.go b/cmd/auth/logout.go
index d1d559b0a60..7daf17be3e2 100644
--- a/cmd/auth/logout.go
+++ b/cmd/auth/logout.go
@@ -273,6 +273,11 @@ func clearTokenStore(ctx context.Context, p profile.Profile, profiler profile.Pr
 	if err := tokenStore.Delete(p.Name); err != nil {
 		return fmt.Errorf("failed to delete profile-keyed token for profile %q: %w", p.Name, err)
 	}
+	// A pending device code login could still complete and restore the
+	// credentials that the user is logging out of.
+	if err := tokenStore.Delete(pendingLoginKey(p.Name)); err != nil {
+		return fmt.Errorf("failed to delete pending device code login for profile %q: %w", p.Name, err)
+	}
 
 	hostCacheKey, matchFn := hostCacheKeyAndMatchFn(p)
 	if hostCacheKey == "" {
@@ -293,6 +298,9 @@ func clearTokenStore(ctx context.Context, p profile.Profile, profiler profile.Pr
 		if err := tokenStore.Delete(hostCacheKey); err != nil {
 			return fmt.Errorf("failed to delete host-keyed token for %q: %w", hostCacheKey, err)
 		}
+		if err := tokenStore.Delete(pendingLoginKey(hostCacheKey)); err != nil {
+			return fmt.Errorf("failed to delete pending device code login for %q: %w", hostCacheKey, err)
+		}
 	}
 	return nil
 }
diff --git a/docs/device-code-login.md b/docs/device-code-login.md
index 08f1fcab358..165789c8c2a 100644
--- a/docs/device-code-login.md
+++ b/docs/device-code-login.md
@@ -46,11 +46,61 @@ Profile my-profile was successfully saved
 4. The browser shows a confirmation code. Type it into the CLI. Codes are not
    case-sensitive, and the dash is optional. If the code is rejected, the CLI
    asks for it again and shows how many attempts are left, up to 3 attempts in
-   total. Never share the confirmation code with anyone.
+   total. Only give the confirmation code to the CLI that started the login,
+   or to the AI agent that runs it (see
+   [Log in without a terminal](#log-in-without-a-terminal)). Never share it
+   with anyone else.
 
 The CLI saves the profile and the token the same way as the browser-based
 `databricks auth login`, so other commands use it via `--profile my-profile`.
 
+## Log in without a terminal
+
+When stdin is not a terminal, nobody can type the confirmation code into the
+running CLI. This is the case when a script or an AI agent such as Claude Code
+runs the login as a one-off command. The login then runs non-interactively, in
+two steps:
+
+```console
+$ databricks auth login --host https://<workspace-host> --profile my-profile --use-device-code < /dev/null
+Using a browser on another device, visit:
+https://<workspace-host>/device/verification
+
+And enter the code:
+WDJB-MJHT
+
+Once finished, complete the login by running the same command with
+--user-code WDJB-MJHT and --confirmation-code set to the confirmation code
+provided in your browser.
+$ databricks auth login --host https://<workspace-host> --profile my-profile --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Profile my-profile was successfully saved
+```
+
+1. The first command prints the URL and the code, and keeps the pending login
+   in the CLI's token storage. It does not change the profile, so commands
+   that use it keep working until the login completes.
+2. Approve the login in the browser as described above.
+3. Run the same command with the hidden `--user-code` flag set to the code
+   from step 1 and the hidden `--confirmation-code` flag set to the
+   confirmation code. It saves the profile and the token. Without
+   `--profile`, it only stores the token for the host.
+
+The pending login stays on your machine, so a confirmation code that ends up
+somewhere else, such as an agent's conversation, cannot complete the login on
+another machine.
+
+If the confirmation code is rejected, check it and run the command again. If
+the login expired, start a new one.
+
+Each profile, or host without a profile, has one pending login. Starting a
+second login for it replaces the first, so complete one login before starting
+another.
+
+`databricks auth logout` removes the pending login of the profile.
+
+`--configure-cluster` is not supported by the non-interactive login. Set
+`cluster_id` on the profile after the login.
+
 ## Session lifetime
 
 The token is renewed automatically for up to 24 hours. After that, commands
@@ -68,5 +118,12 @@ fail with a token refresh error and you need to run the login again.
 | `token exchange: Invalid device code` | The login expired. A confirmation code entered after the login expired is first rejected as `Invalid confirmation code`, and the workspace then discards the login. | Run the login again to get a new code. |
 | `token exchange: Device grant rate limit exceeded` | Too many confirmation codes were sent for this login. | Run the login again to get a new code. |
 | `unauthorized_client` or `invalid_client` | The OAuth client is not allowed to use device code login in this workspace. | Use the default `databricks-cli` client, or ask your admin to enable the custom client. |
-| `reading confirmation code: EOF` | stdin was closed before a code was entered. | Keep stdin open until you write the confirmation code. |
+| `--configure-cluster is not supported by the non-interactive device code login` | The cluster picker needs a terminal. | Log in first, then set `cluster_id` on the profile. |
+| `token exchange: Invalid confirmation code (error code: invalid_request). Check the confirmation code ...` | The confirmation code was mistyped, or the login was not approved yet. | Check the code and approve the login, then run the command again. If it still fails, start a new login. |
+| `token exchange: Invalid device code (error code: invalid_request). Run the same command without --user-code and --confirmation-code ...` | The login expired. | Start a new login. |
+| `a newer login for profile ... replaced this one` | A second login was started for the same profile or host. | Approve the newest code, and complete the newest login with its user code. |
+| `no pending device code login for profile ...` | The login was already completed, or no login was started for this profile or host. | Start a new login. |
+| `--confirmation-code requires --user-code` | `--user-code` is missing from the command. | Add `--user-code` with the code from the first step. |
+| `--confirmation-code requires --use-device-code` | `--use-device-code` is missing from the command. | Run the same command as the first step, with `--user-code` and `--confirmation-code`. |
+| `reading confirmation code: EOF` | The input was closed, e.g. with Ctrl+D, before a code was entered. | Run the login again. |
 | `reading confirmation code: context deadline exceeded` | No confirmation code was entered before the login timed out (1 hour by default). | Run the login again. Use `--timeout` to change the limit. |
diff --git a/libs/auth/storage/filestore.go b/libs/auth/storage/filestore.go
index d7f13d397d3..18586a68ca4 100644
--- a/libs/auth/storage/filestore.go
+++ b/libs/auth/storage/filestore.go
@@ -51,6 +51,7 @@ const (
 // the historical bare-token format, leaving room for additive sibling fields.
 type fileEntry struct {
 	*oauth2.Token
+	PendingLogin *PendingLogin `json:"pending_login,omitempty"`
 }
 
 // tokenStoreFile is the format of the token store file.
@@ -107,7 +108,7 @@ func (c *fileStore) Put(key string, e Entry) error {
 	if f.Tokens == nil {
 		f.Tokens = map[string]*fileEntry{}
 	}
-	f.Tokens[key] = &fileEntry{Token: e.Token}
+	f.Tokens[key] = &fileEntry{Token: e.Token, PendingLogin: e.PendingLogin}
 	return c.write(f)
 }
 
@@ -123,7 +124,7 @@ func (c *fileStore) Lookup(key string) (Entry, error) {
 	if !ok {
 		return Entry{}, ErrNotFound
 	}
-	return Entry{Token: fe.Token}, nil
+	return Entry{Token: fe.Token, PendingLogin: fe.PendingLogin}, nil
 }
 
 // Delete implements the Store interface. Removing a missing key is a no-op.
diff --git a/libs/auth/storage/filestore_test.go b/libs/auth/storage/filestore_test.go
index d905e304839..68e847cb4a1 100644
--- a/libs/auth/storage/filestore_test.go
+++ b/libs/auth/storage/filestore_test.go
@@ -36,6 +36,28 @@ func TestStoreAndLookup(t *testing.T) {
 	assert.Equal(t, ErrNotFound, err)
 }
 
+func TestStoreAndLookupPendingLogin(t *testing.T) {
+	f := setup(t)
+	c, err := NewFileStore(t.Context(), WithFileLocation(f))
+	require.NoError(t, err)
+	pending := &PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
+	require.NoError(t, c.Put("x#device-code", Entry{PendingLogin: pending}))
+
+	got, err := c.Lookup("x#device-code")
+	require.NoError(t, err)
+	assert.Nil(t, got.Token)
+	assert.Equal(t, pending, got.PendingLogin)
+
+	raw, err := os.ReadFile(f)
+	require.NoError(t, err)
+	assert.JSONEq(t, `{
+		"version": 1,
+		"tokens": {
+			"x#device-code": {"pending_login": {"device_code": "device-code", "user_code": "WDJBMJHT"}}
+		}
+	}`, string(raw))
+}
+
 func TestNoStoreFileReturnsErrNotConfigured(t *testing.T) {
 	l, err := NewFileStore(t.Context(), WithFileLocation(setup(t)))
 	require.NoError(t, err)
diff --git a/libs/auth/storage/keyring.go b/libs/auth/storage/keyring.go
index e499c00490c..1beccdca3e5 100644
--- a/libs/auth/storage/keyring.go
+++ b/libs/auth/storage/keyring.go
@@ -47,7 +47,8 @@ type keyringBackend interface {
 // checksum, store time, ...) without breaking older CLI versions that read
 // the same entry.
 type keyringEntry struct {
-	Token *oauth2.Token `json:"token"`
+	Token        *oauth2.Token `json:"token"`
+	PendingLogin *PendingLogin `json:"pending_login,omitempty"`
 }
 
 // zalandoBackend delegates to the process-wide zalando/go-keyring provider.
diff --git a/libs/auth/storage/keyring_test.go b/libs/auth/storage/keyring_test.go
index 7418bf7c7e8..77a7ced4779 100644
--- a/libs/auth/storage/keyring_test.go
+++ b/libs/auth/storage/keyring_test.go
@@ -118,6 +118,19 @@ func TestKeyringStore_Lookup_ReturnsStoredToken(t *testing.T) {
 	assert.Equal(t, "Bearer", got.Token.TokenType)
 }
 
+func TestKeyringStore_Lookup_ReturnsStoredPendingLogin(t *testing.T) {
+	backend := newFakeBackend()
+	c := newTestStore(backend)
+
+	want := &PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
+	require.NoError(t, c.Put("my-profile#device-code", Entry{PendingLogin: want}))
+
+	got, err := c.Lookup("my-profile#device-code")
+	require.NoError(t, err)
+	assert.Nil(t, got.Token)
+	assert.Equal(t, want, got.PendingLogin)
+}
+
 func TestKeyringStore_Lookup_MissingReturnsCacheErrNotFound(t *testing.T) {
 	backend := newFakeBackend()
 	c := newTestStore(backend)
diff --git a/libs/auth/storage/memory.go b/libs/auth/storage/memory.go
index 60918968c31..d639cf5f108 100644
--- a/libs/auth/storage/memory.go
+++ b/libs/auth/storage/memory.go
@@ -29,6 +29,10 @@ func cloneToken(t *oauth2.Token) *oauth2.Token {
 
 func cloneEntry(e Entry) Entry {
 	e.Token = cloneToken(e.Token)
+	if e.PendingLogin != nil {
+		pending := *e.PendingLogin
+		e.PendingLogin = &pending
+	}
 	return e
 }
 
diff --git a/libs/auth/storage/memory_test.go b/libs/auth/storage/memory_test.go
index abccf029248..7c8f4b6109b 100644
--- a/libs/auth/storage/memory_test.go
+++ b/libs/auth/storage/memory_test.go
@@ -55,6 +55,24 @@ func TestMemoryStore_PutAndLookupUseCopies(t *testing.T) {
 	}
 }
 
+func TestMemoryStore_PendingLoginUsesCopies(t *testing.T) {
+	s := NewMemoryStore()
+	pending := &PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
+	if err := s.Put("key1", Entry{PendingLogin: pending}); err != nil {
+		t.Fatalf("Put: %v", err)
+	}
+
+	pending.DeviceCode = "mutated-after-store"
+
+	got, err := s.Lookup("key1")
+	if err != nil {
+		t.Fatalf("Lookup: %v", err)
+	}
+	if got.PendingLogin.DeviceCode != "device-code" {
+		t.Fatalf("DeviceCode after store mutation: want %q, got %q", "device-code", got.PendingLogin.DeviceCode)
+	}
+}
+
 func TestMemoryStore_Delete(t *testing.T) {
 	s := NewMemoryStore()
 	if err := s.Put("key1", Entry{Token: &oauth2.Token{AccessToken: "abc"}}); err != nil {
diff --git a/libs/auth/storage/storage.go b/libs/auth/storage/storage.go
index 3aad20fc645..90253c55dcb 100644
--- a/libs/auth/storage/storage.go
+++ b/libs/auth/storage/storage.go
@@ -24,8 +24,25 @@ var ErrNotFound = errors.New("token not found")
 // without changing the Store interface. Backends persist it verbatim and never
 // interpret its contents.
 type Entry struct {
-	// Token is the cached OAuth token. Always set for stored entries.
+	// Token is the cached OAuth token. Set for every stored entry except a
+	// pending login.
 	Token *oauth2.Token
+
+	// PendingLogin is set instead of Token for a login that one CLI
+	// invocation started and a later one completes.
+	PendingLogin *PendingLogin
+}
+
+// PendingLogin is a device code login that is waiting for the user's
+// confirmation code. Keeping the device code in the store means it never
+// leaves the machine that started the login.
+type PendingLogin struct {
+	// DeviceCode is exchanged together with the confirmation code for a token.
+	DeviceCode string `json:"device_code"`
+
+	// UserCode is the code the user enters in the browser. It identifies the
+	// login when a newer one replaced it under the same key.
+	UserCode string `json:"user_code"`
 }
 
 // Store is the CLI's token-storage abstraction: a key/value store with no
diff --git a/libs/auth/u2m/device_code.go b/libs/auth/u2m/device_code.go
index 5feb16f0839..b062490b69e 100644
--- a/libs/auth/u2m/device_code.go
+++ b/libs/auth/u2m/device_code.go
@@ -117,7 +117,7 @@ func (l *DeviceCodeLogin) RequestDeviceAuthorization(ctx context.Context) (*Devi
 // code valid, so the exchange can be retried with the right code. The caller
 // is responsible for storing the returned token.
 func (l *DeviceCodeLogin) RequestDeviceAccessToken(ctx context.Context, deviceCode, confirmationCode string) (*oauth2.Token, error) {
-	t, err := l.auth.exchangeDeviceCode(ctx, l.cfg, deviceCode, normalizeCode(confirmationCode))
+	t, err := l.auth.exchangeDeviceCode(ctx, l.cfg, deviceCode, NormalizeCode(confirmationCode))
 	if err == nil {
 		return t, nil
 	}
@@ -266,10 +266,10 @@ func (a *PersistentAuth) postForm(ctx context.Context, endpoint string, form url
 	return body, nil
 }
 
-// normalizeCode lets users enter a code the way it is displayed. Databricks
+// NormalizeCode lets users enter a code the way it is displayed. Databricks
 // codes consist of 8 uppercase alphanumeric characters and are compared
 // case-sensitively, but are often shown as two groups of four separated by a
 // dash (e.g. FTFA-QQKY).
-func normalizeCode(code string) string {
+func NormalizeCode(code string) string {
 	return strings.NewReplacer("-", "", " ", "").Replace(strings.ToUpper(strings.TrimSpace(code)))
 }
diff --git a/libs/auth/u2m/device_code_test.go b/libs/auth/u2m/device_code_test.go
index 27968fd7d34..b5d98a00d06 100644
--- a/libs/auth/u2m/device_code_test.go
+++ b/libs/auth/u2m/device_code_test.go
@@ -364,6 +364,6 @@ func TestNormalizeCode(t *testing.T) {
 		{"  FTFA QQKY \n", "FTFAQQKY"},
 	}
 	for _, tc := range tests {
-		assert.Equal(t, tc.want, normalizeCode(tc.in), tc.in)
+		assert.Equal(t, tc.want, NormalizeCode(tc.in), tc.in)
 	}
 }
diff --git a/libs/cmdio/io.go b/libs/cmdio/io.go
index 2b9b395ce13..7f0dd853e8c 100644
--- a/libs/cmdio/io.go
+++ b/libs/cmdio/io.go
@@ -83,6 +83,15 @@ func IsPromptSupported(ctx context.Context) bool {
 	return c.capabilities.SupportsPrompt()
 }
 
+// IsInputTTY reports whether stdin is a terminal, so that a user can type
+// input into the command. Unlike IsPromptSupported, it does not depend on
+// stderr, NO_COLOR, TERM=dumb or Git Bash, which only matter for rendering
+// prompts.
+func IsInputTTY(ctx context.Context) bool {
+	c := fromContext(ctx)
+	return c.capabilities.stdinIsTTY
+}
+
 // IsPagerSupported reports whether stdin, stdout, and stderr are all interactive
 // terminals. This is the requirement for a full-screen or navigable output
 // program: unlike IsPromptSupported it also checks stdout, so it returns false
diff --git a/libs/cmdio/io_test.go b/libs/cmdio/io_test.go
index 23872d5f95c..7c5aad9a6a6 100644
--- a/libs/cmdio/io_test.go
+++ b/libs/cmdio/io_test.go
@@ -3,6 +3,8 @@ package cmdio
 import (
 	"testing"
 	"time"
+
+	"github.com/stretchr/testify/assert"
 )
 
 func TestAcquireTeaProgramWaitsForRelease(t *testing.T) {
@@ -34,3 +36,14 @@ func TestAcquireTeaProgramWaitsForRelease(t *testing.T) {
 
 	c.releaseTeaProgram()
 }
+
+func TestIsInputTTY(t *testing.T) {
+	// Prompts are not supported without stderr as a terminal and with color,
+	// but a user can still type into stdin.
+	ctx := InContext(t.Context(), &cmdIO{capabilities: Capabilities{stdinIsTTY: true}})
+	assert.True(t, IsInputTTY(ctx))
+	assert.False(t, IsPromptSupported(ctx))
+
+	ctx = InContext(t.Context(), &cmdIO{capabilities: Capabilities{stderrIsTTY: true, color: true}})
+	assert.False(t, IsInputTTY(ctx))
+}

From f0b4dbec460b6c18b5dd553c0596f31d73408c15 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Thu, 29 Oct 2026 13:07:32 +0000
Subject: [PATCH 02/29] Share the device code approval instructions between
 both logins

The interactive and the non-interactive device code login printed the same
lines that show where to approve the login. approvalInstructions returns
them for both, so they cannot drift apart.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/login_device_code.go | 35 ++++++++++++++++++-----------------
 1 file changed, 18 insertions(+), 17 deletions(-)

diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index d1e6513310d..3c3e19ada0a 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -169,17 +169,11 @@ func (l nonInteractiveDeviceCodeLogin) start(ctx context.Context) error {
 	if err != nil {
 		return fmt.Errorf("store pending login: %w", err)
 	}
-	cmdio.LogString(ctx, strings.Join([]string{
-		"Using a browser on another device, visit:",
-		da.VerificationURI,
-		"",
-		"And enter the code:",
-		formatCode(da.UserCode),
-		"",
+	cmdio.LogString(ctx, strings.Join(append(approvalInstructions(*da),
 		"Once finished, complete the login by running the same command with",
-		"--user-code " + formatCode(da.UserCode) + " and --confirmation-code set to the confirmation code",
+		"--user-code "+formatCode(da.UserCode)+" and --confirmation-code set to the confirmation code",
 		"provided in your browser.",
-	}, "\n"))
+	), "\n"))
 	return nil
 }
 
@@ -241,15 +235,9 @@ func sameCode(a, b string) bool {
 // and asks again.
 func promptForConfirmationCode(ctx context.Context, da u2m.DeviceAuthorization, lastErr error, attemptsLeft int) (string, error) {
 	if lastErr == nil {
-		cmdio.LogString(ctx, strings.Join([]string{
-			"Using a browser on another device, visit:",
-			da.VerificationURI,
-			"",
-			"And enter the code:",
-			formatCode(da.UserCode),
-			"",
+		cmdio.LogString(ctx, strings.Join(append(approvalInstructions(da),
 			"Once finished, enter the confirmation code provided in your browser.",
-		}, "\n"))
+		), "\n"))
 	} else {
 		attempts := "attempts"
 		if attemptsLeft == 1 {
@@ -268,6 +256,19 @@ func promptForConfirmationCode(ctx context.Context, da u2m.DeviceAuthorization,
 	return code, nil
 }
 
+// approvalInstructions returns the lines that show the user where to approve
+// the login. Both flows print them before saying how to complete the login.
+func approvalInstructions(da u2m.DeviceAuthorization) []string {
+	return []string{
+		"Using a browser on another device, visit:",
+		da.VerificationURI,
+		"",
+		"And enter the code:",
+		formatCode(da.UserCode),
+		"",
+	}
+}
+
 // formatCode displays an 8-character device code as two groups of four
 // separated by a dash, matching how the browser displays codes.
 func formatCode(code string) string {

From 2326100babae513954b0782c262343039e5e58c7 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Thu, 29 Oct 2026 13:08:08 +0000
Subject: [PATCH 03/29] Test that completing a device code login checks the
 user code

Only an acceptance test covered the check. The unit test completes a
login with the user code of another login, checks that no token request
is sent, and then completes it with the right user code in another
format.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/login_device_code_test.go | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index 85f0db7ced0..8ddace84c9f 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -516,6 +516,31 @@ func TestLoginDeviceCodeCompletesInTerminal(t *testing.T) {
 	assert.Empty(t, profiles)
 }
 
+// A user code that does not match the pending login fails before the token
+// exchange, so the confirmation code is not sent with the device code of
+// another login.
+func TestLoginDeviceCodeCompletionChecksUserCode(t *testing.T) {
+	server := newDeviceCodeServer(t)
+	var tokenRequests atomic.Int32
+	server.RequestCallback = func(req *testserver.Request) {
+		if req.URL.Path == "/oidc/v1/token" {
+			tokenRequests.Add(1)
+		}
+	}
+	setUpDeviceCodeLogin(t, "")
+	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), flags.OutputText, strings.NewReader(""), &bytes.Buffer{}, &bytes.Buffer{}, "", ""))
+	require.NoError(t, runDeviceCodeLogin(ctx, "--host", server.URL, "--profile", "test"))
+
+	err := runDeviceCodeLogin(ctx, "--host", server.URL, "--profile", "test", "--user-code", "AAAA-AAAA", "--confirmation-code", "FTFA-QQKY")
+	assert.EqualError(t, err, "a newer login for profile test replaced this one. Complete the newer login with its user code. "+startNewLoginHint)
+	assert.Zero(t, tokenRequests.Load())
+
+	// The pending login is kept, and the user code is compared the way the
+	// user enters it.
+	require.NoError(t, runDeviceCodeLogin(ctx, "--host", server.URL, "--profile", "test", "--user-code", "wdjbmjht", "--confirmation-code", "FTFA-QQKY"))
+	assert.Equal(t, int32(1), tokenRequests.Load())
+}
+
 func TestLoginDeviceCodeCompletionWithoutHostSkipsPicker(t *testing.T) {
 	tm := startDeviceCodeLogin(t, "", "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY")
 	_, err := tm.Result()

From af33dc627de2db5fa6e1100b6e6735a5dce16df0 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Thu, 29 Oct 2026 13:23:57 +0000
Subject: [PATCH 04/29] Delete the pending device code login after a successful
 login

A pending device code login stayed in the token store after the profile
or host logged in another way, e.g. in the browser or with a device code
login in a terminal. storeLoginToken, which every login goes through,
now deletes the pending login of the same profile or host, so the
non-interactive completion no longer deletes it itself.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/README.md            | 13 +++++++------
 cmd/auth/login.go             |  5 +++++
 cmd/auth/login_device_code.go |  9 +++++----
 cmd/auth/login_test.go        | 18 ++++++++++++++++++
 docs/device-code-login.md     |  3 ++-
 5 files changed, 37 insertions(+), 11 deletions(-)

diff --git a/cmd/auth/README.md b/cmd/auth/README.md
index 2b227825b77..5a56acbec54 100644
--- a/cmd/auth/README.md
+++ b/cmd/auth/README.md
@@ -132,9 +132,10 @@ from, e.g., an agent's transcript cannot complete the login on another machine.
 Each target has one pending login, and a new login for it replaces the old
 one. The second step checks the user code, so a replaced login fails with a
 clear error without sending its confirmation code. A wrong confirmation code
-keeps the pending login for a rerun. A successful exchange, or a device code
-the server no longer knows, deletes it. The CLI does not expire pending logins
-itself: the server does. `auth logout` deletes the pending login of the profile,
-and the one of its host when it deletes the host's token. A pending login for a
-profile that was never saved, or for a host that no profile uses, stays until a
-new login for it replaces it.
+keeps the pending login for a rerun. A device code the server no longer knows
+deletes it, and so does any successful login for the same target
+(`storeLoginToken`), with or without device code. The CLI does not expire
+pending logins itself: the server does. `auth logout` deletes the pending login
+of the profile, and the one of its host when it deletes the host's token. A
+pending login for a profile that was never saved, or for a host that no profile
+uses, stays until a new login for it replaces it.
diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index cfbfe03eecd..062f52e8dd7 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -131,6 +131,11 @@ func storeLoginToken(ctx context.Context, tokenStore storage.Store, mode storage
 		}
 		return storeErr
 	}
+	// A pending device code login for the same profile or host is left over
+	// once a login succeeds.
+	if err := tokenStore.Delete(pendingLoginKey(key)); err != nil {
+		log.Debugf(ctx, "Failed to delete the pending device code login: %v", err)
+	}
 	storage.PinSecureMode(ctx, mode, storage.StorageModeUnknown)
 	return nil
 }
diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index 3c3e19ada0a..c48ed9d9c57 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -206,10 +206,11 @@ func (l nonInteractiveDeviceCodeLogin) complete(ctx context.Context, userCode, c
 	if err != nil {
 		err = fmt.Errorf("token exchange: %w", err)
 	}
-	// A wrong confirmation code leaves the device code valid, so the pending
-	// login is kept for a rerun. Otherwise the server no longer accepts the
-	// device code.
-	if err == nil || errors.Is(err, u2m.ErrInvalidDeviceCode) {
+	// The server no longer accepts an invalid device code, so its pending
+	// login is deleted. A wrong confirmation code leaves the device code
+	// valid, so the pending login is kept for a rerun. After a successful
+	// exchange, storeLoginToken deletes it.
+	if errors.Is(err, u2m.ErrInvalidDeviceCode) {
 		if err := l.tokenStore.Delete(l.key); err != nil {
 			log.Debugf(ctx, "Failed to delete the pending device code login: %v", err)
 		}
diff --git a/cmd/auth/login_test.go b/cmd/auth/login_test.go
index 3bbf7249e45..58fd6455449 100644
--- a/cmd/auth/login_test.go
+++ b/cmd/auth/login_test.go
@@ -73,6 +73,24 @@ func TestStoreLoginTokenDeletesStaleTokenOnFailure(t *testing.T) {
 	assert.ErrorIs(t, err, storage.ErrNotFound)
 }
 
+func TestStoreLoginTokenDeletesPendingDeviceCodeLogin(t *testing.T) {
+	const profileName = "TEST"
+	store := storage.NewMemoryStore()
+	pending := storage.Entry{PendingLogin: &storage.PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}}
+	require.NoError(t, store.Put(pendingLoginKey(profileName), pending))
+	require.NoError(t, store.Put(pendingLoginKey("OTHER"), pending))
+	arg, err := u2m.NewProfileWorkspaceOAuthArgument("https://workspace.example.test", profileName)
+	require.NoError(t, err)
+
+	err = storeLoginToken(t.Context(), store, storage.StorageModeSecure, arg, &oauth2.Token{AccessToken: "new-token"})
+
+	require.NoError(t, err)
+	_, err = store.Lookup(pendingLoginKey(profileName))
+	assert.ErrorIs(t, err, storage.ErrNotFound)
+	_, err = store.Lookup(pendingLoginKey("OTHER"))
+	assert.NoError(t, err)
+}
+
 // logBuffer is a thread-safe bytes.Buffer for capturing log output in tests.
 type logBuffer struct {
 	mu  sync.Mutex
diff --git a/docs/device-code-login.md b/docs/device-code-login.md
index 165789c8c2a..fab9ac4614e 100644
--- a/docs/device-code-login.md
+++ b/docs/device-code-login.md
@@ -96,7 +96,8 @@ Each profile, or host without a profile, has one pending login. Starting a
 second login for it replaces the first, so complete one login before starting
 another.
 
-`databricks auth logout` removes the pending login of the profile.
+A successful login for the profile, in any way, and `databricks auth logout`
+remove its pending login.
 
 `--configure-cluster` is not supported by the non-interactive login. Set
 `cluster_id` on the profile after the login.

From d60c40b63184f9e9ba755651b4a6e52fcaefa43e Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Thu, 29 Oct 2026 13:25:10 +0000
Subject: [PATCH 05/29] Reject an empty --user-code or --confirmation-code

An empty --user-code failed with "a newer login ... replaced this one",
and an empty --confirmation-code was sent to the server. Both now fail
before the login with an error that names the empty flag.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/login.go                  |  4 ++--
 cmd/auth/login_device_code.go      | 12 ++++++++++--
 cmd/auth/login_device_code_test.go | 28 ++++++++++++++++++----------
 3 files changed, 30 insertions(+), 14 deletions(-)

diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index 062f52e8dd7..a46dc251e0d 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -248,10 +248,10 @@ a new profile is created.
 			}
 		}
 
-		completeLogin := cmd.Flags().Changed("confirmation-code")
-		if err := validateDeviceCodeCompletionFlags(useDeviceCode, cmd.Flags().Changed("user-code"), completeLogin); err != nil {
+		if err := validateDeviceCodeCompletionFlags(cmd, useDeviceCode); err != nil {
 			return err
 		}
+		completeLogin := cmd.Flags().Changed("confirmation-code")
 		// Device code login reads the confirmation code from stdin. When stdin
 		// is not a terminal, e.g. when an AI agent runs the login as a one-off
 		// command, nobody can type the code in. The non-interactive login then
diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index c48ed9d9c57..b152f9e4a45 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -111,8 +111,11 @@ func deviceCodeLogin(ctx context.Context, persistentAuth *u2m.PersistentAuth) (*
 }
 
 // validateDeviceCodeCompletionFlags returns an error if the flags that complete
-// a non-interactive device code login are not set together.
-func validateDeviceCodeCompletionFlags(useDeviceCode, hasUserCode, hasConfirmationCode bool) error {
+// a non-interactive device code login are not set together, or are set to an
+// empty code.
+func validateDeviceCodeCompletionFlags(cmd *cobra.Command, useDeviceCode bool) error {
+	hasUserCode := cmd.Flags().Changed("user-code")
+	hasConfirmationCode := cmd.Flags().Changed("confirmation-code")
 	switch {
 	case hasConfirmationCode && !hasUserCode:
 		return errors.New("--confirmation-code requires --user-code")
@@ -121,6 +124,11 @@ func validateDeviceCodeCompletionFlags(useDeviceCode, hasUserCode, hasConfirmati
 	case hasConfirmationCode && !useDeviceCode:
 		return errors.New("--confirmation-code requires --use-device-code")
 	}
+	for _, name := range []string{"user-code", "confirmation-code"} {
+		if f := cmd.Flag(name); f.Changed && strings.TrimSpace(f.Value.String()) == "" {
+			return fmt.Errorf("--%s cannot be empty", name)
+		}
+	}
 	return nil
 }
 
diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index 8ddace84c9f..62d98ca8824 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -373,21 +373,29 @@ resources = https://workspace.test/ai-gateway/mcp-services/system.ai.github
 
 func TestValidateDeviceCodeCompletionFlags(t *testing.T) {
 	tests := []struct {
-		name                string
-		useDeviceCode       bool
-		hasUserCode         bool
-		hasConfirmationCode bool
-		wantErr             string
+		name          string
+		useDeviceCode bool
+		flags         map[string]string
+		wantErr       string
 	}{
 		{name: "neither", useDeviceCode: true},
-		{name: "both", useDeviceCode: true, hasUserCode: true, hasConfirmationCode: true},
-		{name: "confirmation code only", useDeviceCode: true, hasConfirmationCode: true, wantErr: "--confirmation-code requires --user-code"},
-		{name: "user code only", useDeviceCode: true, hasUserCode: true, wantErr: "--user-code requires --confirmation-code"},
-		{name: "without device code", hasUserCode: true, hasConfirmationCode: true, wantErr: "--confirmation-code requires --use-device-code"},
+		{name: "both", useDeviceCode: true, flags: map[string]string{"user-code": "WDJB-MJHT", "confirmation-code": "FTFA-QQKY"}},
+		{name: "confirmation code only", useDeviceCode: true, flags: map[string]string{"confirmation-code": "FTFA-QQKY"}, wantErr: "--confirmation-code requires --user-code"},
+		{name: "user code only", useDeviceCode: true, flags: map[string]string{"user-code": "WDJB-MJHT"}, wantErr: "--user-code requires --confirmation-code"},
+		{name: "without device code", flags: map[string]string{"user-code": "WDJB-MJHT", "confirmation-code": "FTFA-QQKY"}, wantErr: "--confirmation-code requires --use-device-code"},
+		{name: "empty user code", useDeviceCode: true, flags: map[string]string{"user-code": "", "confirmation-code": "FTFA-QQKY"}, wantErr: "--user-code cannot be empty"},
+		{name: "blank confirmation code", useDeviceCode: true, flags: map[string]string{"user-code": "WDJB-MJHT", "confirmation-code": "  "}, wantErr: "--confirmation-code cannot be empty"},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			err := validateDeviceCodeCompletionFlags(tt.useDeviceCode, tt.hasUserCode, tt.hasConfirmationCode)
+			cmd := &cobra.Command{}
+			cmd.Flags().String("user-code", "", "")
+			cmd.Flags().String("confirmation-code", "", "")
+			for name, value := range tt.flags {
+				require.NoError(t, cmd.Flags().Set(name, value))
+			}
+
+			err := validateDeviceCodeCompletionFlags(cmd, tt.useDeviceCode)
 			if tt.wantErr != "" {
 				assert.EqualError(t, err, tt.wantErr)
 			} else {

From 9bb2edb2d44a7b4ef50f8ab2c356381f86d7592e Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Thu, 29 Oct 2026 13:34:39 +0000
Subject: [PATCH 06/29] Remove device code login tests that the retry test
 covers

TestLoginDeviceCodeWrongConfirmationCode checks three wrong codes and a
login without input, and also counts the token requests, so the tests
for the same cases are no longer needed.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/login_device_code_test.go | 18 ------------------
 1 file changed, 18 deletions(-)

diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index 62d98ca8824..1543fb8f65d 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -450,24 +450,6 @@ func TestLoginDeviceCodeReadsConfirmationCode(t *testing.T) {
 	assert.Contains(t, cache.Tokens, "test")
 }
 
-func TestLoginDeviceCodeFailsAfterWrongConfirmationCodes(t *testing.T) {
-	server := newDeviceCodeServer(t)
-	tm := startDeviceCodeLogin(t, "[test]\nhost = "+server.URL+"\n", "--profile", "test")
-	tm.WaitFor("Confirmation code")
-	tm.Type("AAAA-AAAA\nBBBB-BBBB\nCCCC-CCCC\n")
-	_, err := tm.Result()
-	assert.EqualError(t, err, "Invalid confirmation code (error code: invalid_request). Start login from scratch")
-}
-
-func TestLoginDeviceCodeFailsWithoutConfirmationCode(t *testing.T) {
-	server := newDeviceCodeServer(t)
-	tm := startDeviceCodeLogin(t, "[test]\nhost = "+server.URL+"\n", "--profile", "test")
-	tm.WaitFor("Confirmation code")
-	tm.Close()
-	_, err := tm.Result()
-	assert.EqualError(t, err, "reading confirmation code: EOF")
-}
-
 // The token gets the scopes requested at device authorization, so --scopes is
 // sent there and not with the token request.
 func TestLoginDeviceCodeRequestsScopes(t *testing.T) {

From 8b5aec3fa894e6261d0566de25f00bef8c80509b Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Thu, 29 Oct 2026 15:20:28 +0000
Subject: [PATCH 07/29] Pass the context to NewDeviceCodeLogin in the
 non-interactive login

NewDeviceCodeLogin now takes a context.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/login_device_code.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index b152f9e4a45..cff9bbab7c7 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -162,7 +162,7 @@ func (l nonInteractiveDeviceCodeLogin) target() string {
 // prints how to complete the login. A pending login under the same key is
 // replaced.
 func (l nonInteractiveDeviceCodeLogin) start(ctx context.Context) error {
-	login, err := l.persistentAuth.NewDeviceCodeLogin()
+	login, err := l.persistentAuth.NewDeviceCodeLogin(ctx)
 	if err != nil {
 		return err
 	}
@@ -206,7 +206,7 @@ func (l nonInteractiveDeviceCodeLogin) complete(ctx context.Context, userCode, c
 		return nil, fmt.Errorf("a newer login for %s replaced this one. Complete the newer login with its user code. %s", l.target(), startNewLoginHint)
 	}
 
-	login, err := l.persistentAuth.NewDeviceCodeLogin()
+	login, err := l.persistentAuth.NewDeviceCodeLogin(ctx)
 	if err != nil {
 		return nil, err
 	}

From a87ed039e0b087795b5483afe425efcd3766bbda Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Thu, 29 Oct 2026 15:23:40 +0000
Subject: [PATCH 08/29] Use require and assert in
 TestMemoryStore_PendingLoginUsesCopies

Co-authored-by: Isaac <no-reply@databricks.com>
---
 libs/auth/storage/memory_test.go | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/libs/auth/storage/memory_test.go b/libs/auth/storage/memory_test.go
index 7c8f4b6109b..2a28d9b197a 100644
--- a/libs/auth/storage/memory_test.go
+++ b/libs/auth/storage/memory_test.go
@@ -6,6 +6,8 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"golang.org/x/oauth2"
 )
 
@@ -58,19 +60,13 @@ func TestMemoryStore_PutAndLookupUseCopies(t *testing.T) {
 func TestMemoryStore_PendingLoginUsesCopies(t *testing.T) {
 	s := NewMemoryStore()
 	pending := &PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
-	if err := s.Put("key1", Entry{PendingLogin: pending}); err != nil {
-		t.Fatalf("Put: %v", err)
-	}
+	require.NoError(t, s.Put("key1", Entry{PendingLogin: pending}))
 
 	pending.DeviceCode = "mutated-after-store"
 
 	got, err := s.Lookup("key1")
-	if err != nil {
-		t.Fatalf("Lookup: %v", err)
-	}
-	if got.PendingLogin.DeviceCode != "device-code" {
-		t.Fatalf("DeviceCode after store mutation: want %q, got %q", "device-code", got.PendingLogin.DeviceCode)
-	}
+	require.NoError(t, err)
+	assert.Equal(t, "device-code", got.PendingLogin.DeviceCode)
 }
 
 func TestMemoryStore_Delete(t *testing.T) {

From 8a9d64eca79d9bab67a8f4a6aba124ed4e6c9337 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Thu, 29 Oct 2026 15:29:30 +0000
Subject: [PATCH 09/29] Keep pending device code logins apart from the tokens

A pending login was a token store entry under the cache key with a
#device-code suffix, which a profile can also be named. A pending login for
profile a then replaced the token of profile a#device-code, auth token for
that profile failed with a nil pointer dereference, and logging out of a
deleted it.

The stores now keep pending logins in their own namespace through a new
PendingLoginStore interface, under the plain cache key: the pending_logins
map of the token cache file, the databricks-cli-pending-login keyring
service, and a separate map in the memory store. Entry holds a token
again, and deleting a missing pending login no longer rewrites the token
cache file on every login and logout.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 .../non-interactive/concurrent/output.txt     | 42 ++++++----
 .../non-interactive/errors/output.txt         | 11 ++-
 .../non-interactive/nominal/output.txt        | 29 ++++---
 .../non-interactive/script.prepare            |  5 +-
 .../pending-device-code-login/output.txt      | 21 +++--
 .../logout/pending-device-code-login/script   | 14 ++--
 cmd/auth/README.md                            | 11 ++-
 cmd/auth/login.go                             | 12 +--
 cmd/auth/login_device_code.go                 | 57 +++++++++-----
 cmd/auth/login_device_code_test.go            |  5 +-
 cmd/auth/login_test.go                        | 14 ++--
 cmd/auth/logout.go                            |  4 +-
 libs/auth/storage/filestore.go                | 66 +++++++++++++++-
 libs/auth/storage/filestore_test.go           | 31 ++++++--
 libs/auth/storage/keyring.go                  | 78 +++++++++++++++----
 libs/auth/storage/keyring_test.go             | 24 ++++--
 libs/auth/storage/memory.go                   | 42 ++++++++--
 libs/auth/storage/memory_test.go              | 21 +++--
 libs/auth/storage/storage.go                  | 31 +++++---
 19 files changed, 381 insertions(+), 137 deletions(-)

diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt
index 641900bd214..05c73211e72 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt
@@ -8,9 +8,12 @@
 >>> update_file.py home/.databricks/token-cache.json WDJBMJHT NEWRCODE
 
 >>> cache_keys
-[
-  "test#device-code"
-]
+{
+  "pending_logins": [
+    "test"
+  ],
+  "tokens": []
+}
 
 >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
 Error: a newer login for profile test replaced this one. Complete the newer login with its user code. Run the same command without --user-code and --confirmation-code to start a new login
@@ -30,13 +33,17 @@ Profile test was successfully saved
 >>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code
 
 >>> cache_keys
-[
-  "a#device-code",
-  "b#device-code",
-  "[DATABRICKS_URL]",
-  "[DATABRICKS_URL]#device-code",
-  "test"
-]
+{
+  "pending_logins": [
+    "a",
+    "b",
+    "[DATABRICKS_URL]"
+  ],
+  "tokens": [
+    "[DATABRICKS_URL]",
+    "test"
+  ]
+}
 
 >>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
 Profile b was successfully saved
@@ -47,12 +54,15 @@ Profile b was successfully saved
 Profile a was successfully saved
 
 >>> cache_keys
-[
-  "a",
-  "b",
-  "[DATABRICKS_URL]",
-  "test"
-]
+{
+  "pending_logins": [],
+  "tokens": [
+    "a",
+    "b",
+    "[DATABRICKS_URL]",
+    "test"
+  ]
+}
 
 >>> print_requests.py --oneline //oidc/v1/token
 {"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-4&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
index a71936588a9..d397d2cd99d 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
@@ -77,10 +77,13 @@ Error: no pending device code login for profile test. Run the same command witho
 Error: token exchange: Invalid device code (error code: invalid_request). Run the same command without --user-code and --confirmation-code to start a new login
 
 >>> cache_keys
-[
-  "[DATABRICKS_URL]",
-  "test"
-]
+{
+  "pending_logins": [],
+  "tokens": [
+    "[DATABRICKS_URL]",
+    "test"
+  ]
+}
 
 >>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
 {"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt
index 5a70dc2fd0c..08e8fffdcac 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt
@@ -18,9 +18,12 @@ provided in your browser.
 home/.databricks/token-cache.json
 
 >>> cache_keys
-[
-  "[DATABRICKS_URL]#device-code"
-]
+{
+  "pending_logins": [
+    "[DATABRICKS_URL]"
+  ],
+  "tokens": []
+}
 
 === Confirm the login
 
@@ -30,9 +33,12 @@ home/.databricks/token-cache.json
 json.access_token = "oauth-token";
 
 >>> cache_keys
-[
-  "[DATABRICKS_URL]"
-]
+{
+  "pending_logins": [],
+  "tokens": [
+    "[DATABRICKS_URL]"
+  ]
+}
 
 === Start the login with a profile
 
@@ -79,10 +85,13 @@ json.access_token = "oauth-token";
 Profile test was successfully saved
 
 >>> cache_keys
-[
-  "[DATABRICKS_URL]",
-  "test"
-]
+{
+  "pending_logins": [],
+  "tokens": [
+    "[DATABRICKS_URL]",
+    "test"
+  ]
+}
 
 >>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
 {"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/script.prepare b/acceptance/cmd/auth/login/device-code/non-interactive/script.prepare
index 447c920c748..bc62f4668ad 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/script.prepare
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/script.prepare
@@ -1,6 +1,7 @@
-# cache_keys lists the keys in the plaintext token cache.
+# cache_keys lists the keys of the tokens and of the pending logins in the
+# plaintext token cache.
 cache_keys() {
-    jq -S '.tokens | keys' "./home/.databricks/token-cache.json"
+    jq -S '{tokens: (.tokens | keys), pending_logins: (.pending_logins // {} | keys)}' "./home/.databricks/token-cache.json"
 }
 
 # start_login traces the first step in "$@" and saves its output to file $1,
diff --git a/acceptance/cmd/auth/logout/pending-device-code-login/output.txt b/acceptance/cmd/auth/logout/pending-device-code-login/output.txt
index b347f1321d4..0cfa26a0164 100644
--- a/acceptance/cmd/auth/logout/pending-device-code-login/output.txt
+++ b/acceptance/cmd/auth/logout/pending-device-code-login/output.txt
@@ -4,16 +4,23 @@
 Logged out of and deleted profile "dev".
 
 === Token cache keys after logout — the host keys are kept, staging shares them
-[
-  "[DATABRICKS_URL]",
-  "[DATABRICKS_URL]#device-code",
-  "staging",
-  "staging#device-code"
-]
+{
+  "pending_logins": [
+    "[DATABRICKS_URL]",
+    "staging"
+  ],
+  "tokens": [
+    "[DATABRICKS_URL]",
+    "staging"
+  ]
+}
 
 === Logout staging
 >>> [CLI] auth logout --profile staging --auto-approve
 Logged out of profile "staging". Use --delete to also remove it from the config file.
 
 === Token cache keys after logout — no profile uses the host anymore
-[]
+{
+  "pending_logins": [],
+  "tokens": []
+}
diff --git a/acceptance/cmd/auth/logout/pending-device-code-login/script b/acceptance/cmd/auth/logout/pending-device-code-login/script
index 1d62f2cb572..cc19983f002 100644
--- a/acceptance/cmd/auth/logout/pending-device-code-login/script
+++ b/acceptance/cmd/auth/logout/pending-device-code-login/script
@@ -16,11 +16,13 @@ cat > "./home/.databricks/token-cache.json" <<EOF
   "version": 1,
   "tokens": {
     "dev": {"access_token": "dev-cached-token", "token_type": "Bearer"},
-    "dev#device-code": {"pending_login": {"device_code": "dev-device-code", "user_code": "WDJBMJHT"}},
     "staging": {"access_token": "staging-cached-token", "token_type": "Bearer"},
-    "staging#device-code": {"pending_login": {"device_code": "staging-device-code", "user_code": "WDJBMJHT"}},
-    "${DATABRICKS_HOST}": {"access_token": "shared-host-token", "token_type": "Bearer"},
-    "${DATABRICKS_HOST}#device-code": {"pending_login": {"device_code": "host-device-code", "user_code": "WDJBMJHT"}}
+    "${DATABRICKS_HOST}": {"access_token": "shared-host-token", "token_type": "Bearer"}
+  },
+  "pending_logins": {
+    "dev": {"device_code": "dev-device-code", "user_code": "WDJBMJHT"},
+    "staging": {"device_code": "staging-device-code", "user_code": "WDJBMJHT"},
+    "${DATABRICKS_HOST}": {"device_code": "host-device-code", "user_code": "WDJBMJHT"}
   }
 }
 EOF
@@ -29,10 +31,10 @@ title "Logout and delete dev"
 trace $CLI auth logout --profile dev --auto-approve --delete
 
 title "Token cache keys after logout — the host keys are kept, staging shares them\n"
-jq -S '.tokens | keys' "./home/.databricks/token-cache.json"
+jq -S '{tokens: (.tokens | keys), pending_logins: (.pending_logins // {} | keys)}' "./home/.databricks/token-cache.json"
 
 title "Logout staging"
 trace $CLI auth logout --profile staging --auto-approve
 
 title "Token cache keys after logout — no profile uses the host anymore\n"
-jq -S '.tokens | keys' "./home/.databricks/token-cache.json"
+jq -S '{tokens: (.tokens | keys), pending_logins: (.pending_logins // {} | keys)}' "./home/.databricks/token-cache.json"
diff --git a/cmd/auth/README.md b/cmd/auth/README.md
index 5a56acbec54..80a62b50076 100644
--- a/cmd/auth/README.md
+++ b/cmd/auth/README.md
@@ -120,10 +120,13 @@ in two steps instead:
    flags exchanges the pending device code instead of requesting a new one,
    and the rest of the login runs as usual.
 
-The pending login is a token store entry with `PendingLogin` set instead of a
-token. Its key is the login's cache key (the profile name, or the host without
-a profile) with a `#device-code` suffix, so the target's current token keeps
-working until the login completes. The device code never leaves the machine;
+The pending login is kept in the token store (`storage.PendingLoginStore`) under
+the login's cache key (the profile name, or the host without a profile), but
+apart from the tokens: in the `pending_logins` map of the token cache file, or
+under the `databricks-cli-pending-login` keyring service. A pending login can
+therefore neither replace a token nor be read as one, whatever a profile is
+named, and the target's current token keeps working until the login completes.
+The device code never leaves the machine;
 only the user code and the confirmation code are printed or passed on the
 command line, and the confirmation code is useless without the device code.
 This keeps the confirmation code's protection against phishing: a code read
diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index a46dc251e0d..800790d558f 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -120,20 +120,20 @@ func (d *defaultDiscoveryClient) IntrospectToken(ctx context.Context, host, acce
 // storeLoginToken persists a token after login has finished any optional
 // profile update.
 func storeLoginToken(ctx context.Context, tokenStore storage.Store, mode storage.StorageMode, arg u2m.OAuthArgument, token *oauth2.Token) error {
-	tokenStore = storage.WrapForOAuthArgument(ctx, tokenStore, mode, arg)
+	store := storage.WrapForOAuthArgument(ctx, tokenStore, mode, arg)
 	key := arg.GetCacheKey()
-	if err := tokenStore.Put(key, storage.Entry{Token: token}); err != nil {
+	if err := store.Put(key, storage.Entry{Token: token}); err != nil {
 		storeErr := fmt.Errorf("store token: %w", err)
 		// The profile is already saved, but the old token may still be present.
 		// Delete it so later commands cannot use it with the updated profile.
-		if deleteErr := tokenStore.Delete(key); deleteErr != nil {
+		if deleteErr := store.Delete(key); deleteErr != nil {
 			return errors.Join(storeErr, fmt.Errorf("delete stale token: %w", deleteErr))
 		}
 		return storeErr
 	}
 	// A pending device code login for the same profile or host is left over
-	// once a login succeeds.
-	if err := tokenStore.Delete(pendingLoginKey(key)); err != nil {
+	// once a login succeeds. The wrapped store does not keep pending logins.
+	if err := deletePendingLogin(tokenStore, key); err != nil {
 		log.Debugf(ctx, "Failed to delete the pending device code login: %v", err)
 	}
 	storage.PinSecureMode(ctx, mode, storage.StorageModeUnknown)
@@ -473,7 +473,7 @@ a new profile is created.
 		nonInteractiveLogin := nonInteractiveDeviceCodeLogin{
 			persistentAuth: persistentAuth,
 			tokenStore:     tokenStore,
-			key:            pendingLoginKey(oauthArgument.GetCacheKey()),
+			key:            oauthArgument.GetCacheKey(),
 			profile:        profileName,
 			host:           authArguments.Host,
 		}
diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index cff9bbab7c7..7bff6d78d16 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -20,11 +20,6 @@ import (
 // for a single device code before the login fails.
 const maxConfirmationAttempts = 3
 
-// pendingLoginKeySuffix marks the token store entry that holds a
-// non-interactive device code login until it completes. The entry sits next to
-// the login's token, so that a token that still works is kept until then.
-const pendingLoginKeySuffix = "#device-code"
-
 // startNewLoginHint ends the errors of a non-interactive device code login
 // that cannot be completed.
 const startNewLoginHint = "Run the same command without --user-code and --confirmation-code to start a new login"
@@ -134,8 +129,8 @@ func validateDeviceCodeCompletionFlags(cmd *cobra.Command, useDeviceCode bool) e
 
 // nonInteractiveDeviceCodeLogin runs the two steps of a device code login
 // that cannot read the confirmation code from stdin. The first step stores the
-// device code as a pending login under key, and the second step exchanges it,
-// so that the device code never leaves the machine.
+// device code as a pending login under key, the cache key of the login, and the
+// second step exchanges it, so that the device code never leaves the machine.
 type nonInteractiveDeviceCodeLogin struct {
 	persistentAuth *u2m.PersistentAuth
 	tokenStore     storage.Store
@@ -144,10 +139,25 @@ type nonInteractiveDeviceCodeLogin struct {
 	host           string
 }
 
-// pendingLoginKey returns the token store key of the pending login for the
-// login with cacheKey.
-func pendingLoginKey(cacheKey string) string {
-	return cacheKey + pendingLoginKeySuffix
+// pendingLoginStore returns the pending logins that tokenStore keeps apart
+// from its tokens. The stores of storage.ResolveStore and
+// storage.ResolveStoreForLogin keep them.
+func pendingLoginStore(tokenStore storage.Store) (storage.PendingLoginStore, error) {
+	s, ok := tokenStore.(storage.PendingLoginStore)
+	if !ok {
+		return nil, fmt.Errorf("%T cannot store a pending device code login", tokenStore)
+	}
+	return s, nil
+}
+
+// deletePendingLogin deletes the pending login under key. A token store that
+// keeps no pending logins has none to delete.
+func deletePendingLogin(tokenStore storage.Store, key string) error {
+	s, ok := tokenStore.(storage.PendingLoginStore)
+	if !ok {
+		return nil
+	}
+	return s.DeletePendingLogin(key)
 }
 
 // target describes the login in errors.
@@ -162,6 +172,10 @@ func (l nonInteractiveDeviceCodeLogin) target() string {
 // prints how to complete the login. A pending login under the same key is
 // replaced.
 func (l nonInteractiveDeviceCodeLogin) start(ctx context.Context) error {
+	pendingLogins, err := pendingLoginStore(l.tokenStore)
+	if err != nil {
+		return err
+	}
 	login, err := l.persistentAuth.NewDeviceCodeLogin(ctx)
 	if err != nil {
 		return err
@@ -170,10 +184,10 @@ func (l nonInteractiveDeviceCodeLogin) start(ctx context.Context) error {
 	if err != nil {
 		return err
 	}
-	err = l.tokenStore.Put(l.key, storage.Entry{PendingLogin: &storage.PendingLogin{
+	err = pendingLogins.PutPendingLogin(l.key, storage.PendingLogin{
 		DeviceCode: da.DeviceCode,
 		UserCode:   da.UserCode,
-	}})
+	})
 	if err != nil {
 		return fmt.Errorf("store pending login: %w", err)
 	}
@@ -188,16 +202,17 @@ func (l nonInteractiveDeviceCodeLogin) start(ctx context.Context) error {
 // complete exchanges the device code of the pending login started with
 // userCode together with confirmationCode for a token.
 func (l nonInteractiveDeviceCodeLogin) complete(ctx context.Context, userCode, confirmationCode string) (*oauth2.Token, error) {
-	e, err := l.tokenStore.Lookup(l.key)
-	if err != nil && !errors.Is(err, storage.ErrNotFound) {
-		return nil, fmt.Errorf("read pending login: %w", err)
+	pendingLogins, err := pendingLoginStore(l.tokenStore)
+	if err != nil {
+		return nil, err
 	}
-	// The key can also hold the token of a profile that happens to be named
-	// like a pending login key.
-	pending := e.PendingLogin
-	if pending == nil {
+	pending, err := pendingLogins.LookupPendingLogin(l.key)
+	if errors.Is(err, storage.ErrNotFound) {
 		return nil, fmt.Errorf("no pending device code login for %s. %s", l.target(), startNewLoginHint)
 	}
+	if err != nil {
+		return nil, fmt.Errorf("read pending login: %w", err)
+	}
 	// Each profile or host has one pending login, so a newer login replaces
 	// it. Checking the user code here avoids sending the confirmation code
 	// with the wrong device code, which the server would reject as a wrong
@@ -219,7 +234,7 @@ func (l nonInteractiveDeviceCodeLogin) complete(ctx context.Context, userCode, c
 	// valid, so the pending login is kept for a rerun. After a successful
 	// exchange, storeLoginToken deletes it.
 	if errors.Is(err, u2m.ErrInvalidDeviceCode) {
-		if err := l.tokenStore.Delete(l.key); err != nil {
+		if err := pendingLogins.DeletePendingLogin(l.key); err != nil {
 			log.Debugf(ctx, "Failed to delete the pending device code login: %v", err)
 		}
 	}
diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index 1543fb8f65d..eadc259729c 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -495,11 +495,12 @@ func TestLoginDeviceCodeCompletesInTerminal(t *testing.T) {
 	raw, err := os.ReadFile(filepath.Join(os.Getenv("HOME"), ".databricks", "token-cache.json"))
 	require.NoError(t, err)
 	var cache struct {
-		Tokens map[string]json.RawMessage `json:"tokens"`
+		Tokens        map[string]json.RawMessage `json:"tokens"`
+		PendingLogins map[string]json.RawMessage `json:"pending_logins"`
 	}
 	require.NoError(t, json.Unmarshal(raw, &cache))
 	assert.Contains(t, cache.Tokens, server.URL)
-	assert.NotContains(t, cache.Tokens, pendingLoginKey(server.URL))
+	assert.Empty(t, cache.PendingLogins)
 
 	profiles, err := profile.DefaultProfiler.LoadProfiles(t.Context(), profile.MatchAllProfiles)
 	require.NoError(t, err)
diff --git a/cmd/auth/login_test.go b/cmd/auth/login_test.go
index 58fd6455449..470136498ad 100644
--- a/cmd/auth/login_test.go
+++ b/cmd/auth/login_test.go
@@ -76,19 +76,23 @@ func TestStoreLoginTokenDeletesStaleTokenOnFailure(t *testing.T) {
 func TestStoreLoginTokenDeletesPendingDeviceCodeLogin(t *testing.T) {
 	const profileName = "TEST"
 	store := storage.NewMemoryStore()
-	pending := storage.Entry{PendingLogin: &storage.PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}}
-	require.NoError(t, store.Put(pendingLoginKey(profileName), pending))
-	require.NoError(t, store.Put(pendingLoginKey("OTHER"), pending))
+	pendingLogins := store.(storage.PendingLoginStore)
+	pending := storage.PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
+	require.NoError(t, pendingLogins.PutPendingLogin(profileName, pending))
+	require.NoError(t, pendingLogins.PutPendingLogin("OTHER", pending))
 	arg, err := u2m.NewProfileWorkspaceOAuthArgument("https://workspace.example.test", profileName)
 	require.NoError(t, err)
 
 	err = storeLoginToken(t.Context(), store, storage.StorageModeSecure, arg, &oauth2.Token{AccessToken: "new-token"})
 
 	require.NoError(t, err)
-	_, err = store.Lookup(pendingLoginKey(profileName))
+	_, err = pendingLogins.LookupPendingLogin(profileName)
 	assert.ErrorIs(t, err, storage.ErrNotFound)
-	_, err = store.Lookup(pendingLoginKey("OTHER"))
+	_, err = pendingLogins.LookupPendingLogin("OTHER")
 	assert.NoError(t, err)
+	got, err := store.Lookup(profileName)
+	require.NoError(t, err)
+	assert.Equal(t, "new-token", got.Token.AccessToken)
 }
 
 // logBuffer is a thread-safe bytes.Buffer for capturing log output in tests.
diff --git a/cmd/auth/logout.go b/cmd/auth/logout.go
index 7daf17be3e2..9e1438acd5c 100644
--- a/cmd/auth/logout.go
+++ b/cmd/auth/logout.go
@@ -275,7 +275,7 @@ func clearTokenStore(ctx context.Context, p profile.Profile, profiler profile.Pr
 	}
 	// A pending device code login could still complete and restore the
 	// credentials that the user is logging out of.
-	if err := tokenStore.Delete(pendingLoginKey(p.Name)); err != nil {
+	if err := deletePendingLogin(tokenStore, p.Name); err != nil {
 		return fmt.Errorf("failed to delete pending device code login for profile %q: %w", p.Name, err)
 	}
 
@@ -298,7 +298,7 @@ func clearTokenStore(ctx context.Context, p profile.Profile, profiler profile.Pr
 		if err := tokenStore.Delete(hostCacheKey); err != nil {
 			return fmt.Errorf("failed to delete host-keyed token for %q: %w", hostCacheKey, err)
 		}
-		if err := tokenStore.Delete(pendingLoginKey(hostCacheKey)); err != nil {
+		if err := deletePendingLogin(tokenStore, hostCacheKey); err != nil {
 			return fmt.Errorf("failed to delete pending device code login for %q: %w", hostCacheKey, err)
 		}
 	}
diff --git a/libs/auth/storage/filestore.go b/libs/auth/storage/filestore.go
index 18586a68ca4..e58f061b9f1 100644
--- a/libs/auth/storage/filestore.go
+++ b/libs/auth/storage/filestore.go
@@ -41,6 +41,12 @@ const (
 	//       "refresh_token": "<refresh_token>",
 	//       "expiry": "<expiry>"
 	//     }
+	//   },
+	//   "pending_logins": {
+	//     "<key>": {
+	//       "device_code": "<device_code>",
+	//       "user_code": "<user_code>"
+	//     }
 	//   }
 	// }
 	tokenStoreVersion = 1
@@ -51,13 +57,17 @@ const (
 // the historical bare-token format, leaving room for additive sibling fields.
 type fileEntry struct {
 	*oauth2.Token
-	PendingLogin *PendingLogin `json:"pending_login,omitempty"`
 }
 
 // tokenStoreFile is the format of the token store file.
 type tokenStoreFile struct {
 	Version int                   `json:"version"`
 	Tokens  map[string]*fileEntry `json:"tokens"`
+
+	// PendingLogins are apart from Tokens, so that their keys cannot clash.
+	// Older CLI versions drop them when they write the file, which only means
+	// that a pending login has to be started again.
+	PendingLogins map[string]PendingLogin `json:"pending_logins,omitempty"`
 }
 
 type FileStoreOption func(*fileStore)
@@ -108,7 +118,7 @@ func (c *fileStore) Put(key string, e Entry) error {
 	if f.Tokens == nil {
 		f.Tokens = map[string]*fileEntry{}
 	}
-	f.Tokens[key] = &fileEntry{Token: e.Token, PendingLogin: e.PendingLogin}
+	f.Tokens[key] = &fileEntry{Token: e.Token}
 	return c.write(f)
 }
 
@@ -124,7 +134,7 @@ func (c *fileStore) Lookup(key string) (Entry, error) {
 	if !ok {
 		return Entry{}, ErrNotFound
 	}
-	return Entry{Token: fe.Token, PendingLogin: fe.PendingLogin}, nil
+	return Entry{Token: fe.Token}, nil
 }
 
 // Delete implements the Store interface. Removing a missing key is a no-op.
@@ -139,6 +149,53 @@ func (c *fileStore) Delete(key string) error {
 	return c.write(f)
 }
 
+// PutPendingLogin implements the PendingLoginStore interface.
+func (c *fileStore) PutPendingLogin(key string, p PendingLogin) error {
+	c.locker.Lock()
+	defer c.locker.Unlock()
+	f, err := c.load()
+	if err != nil {
+		return fmt.Errorf("load: %w", err)
+	}
+	if f.PendingLogins == nil {
+		f.PendingLogins = map[string]PendingLogin{}
+	}
+	f.PendingLogins[key] = p
+	return c.write(f)
+}
+
+// LookupPendingLogin implements the PendingLoginStore interface.
+func (c *fileStore) LookupPendingLogin(key string) (PendingLogin, error) {
+	c.locker.Lock()
+	defer c.locker.Unlock()
+	f, err := c.load()
+	if err != nil {
+		return PendingLogin{}, fmt.Errorf("load: %w", err)
+	}
+	p, ok := f.PendingLogins[key]
+	if !ok {
+		return PendingLogin{}, ErrNotFound
+	}
+	return p, nil
+}
+
+// DeletePendingLogin implements the PendingLoginStore interface. Every login
+// deletes the pending login of its target, so the file is only written when
+// there is one.
+func (c *fileStore) DeletePendingLogin(key string) error {
+	c.locker.Lock()
+	defer c.locker.Unlock()
+	f, err := c.load()
+	if err != nil {
+		return fmt.Errorf("load: %w", err)
+	}
+	if _, ok := f.PendingLogins[key]; !ok {
+		return nil
+	}
+	delete(f.PendingLogins, key)
+	return c.write(f)
+}
+
 // write marshals f and atomically replaces the store file.
 func (c *fileStore) write(f *tokenStoreFile) error {
 	raw, err := json.MarshalIndent(f, "", "  ")
@@ -207,3 +264,6 @@ func (c *fileStore) load() (*tokenStoreFile, error) {
 	}
 	return f, nil
 }
+
+// Compile-time confirmation that fileStore keeps pending logins.
+var _ PendingLoginStore = (*fileStore)(nil)
diff --git a/libs/auth/storage/filestore_test.go b/libs/auth/storage/filestore_test.go
index 68e847cb4a1..8752cf606b9 100644
--- a/libs/auth/storage/filestore_test.go
+++ b/libs/auth/storage/filestore_test.go
@@ -36,26 +36,43 @@ func TestStoreAndLookup(t *testing.T) {
 	assert.Equal(t, ErrNotFound, err)
 }
 
-func TestStoreAndLookupPendingLogin(t *testing.T) {
+func TestPendingLoginIsApartFromTokens(t *testing.T) {
 	f := setup(t)
 	c, err := NewFileStore(t.Context(), WithFileLocation(f))
 	require.NoError(t, err)
-	pending := &PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
-	require.NoError(t, c.Put("x#device-code", Entry{PendingLogin: pending}))
+	pendingLogins := c.(PendingLoginStore)
+	pending := PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
+	require.NoError(t, c.Put("x", Entry{Token: &oauth2.Token{AccessToken: "abc"}}))
+	require.NoError(t, pendingLogins.PutPendingLogin("x", pending))
 
-	got, err := c.Lookup("x#device-code")
+	got, err := c.Lookup("x")
+	require.NoError(t, err)
+	assert.Equal(t, "abc", got.Token.AccessToken)
+	gotPending, err := pendingLogins.LookupPendingLogin("x")
 	require.NoError(t, err)
-	assert.Nil(t, got.Token)
-	assert.Equal(t, pending, got.PendingLogin)
+	assert.Equal(t, pending, gotPending)
+	_, err = pendingLogins.LookupPendingLogin("y")
+	assert.ErrorIs(t, err, ErrNotFound)
 
 	raw, err := os.ReadFile(f)
 	require.NoError(t, err)
 	assert.JSONEq(t, `{
 		"version": 1,
 		"tokens": {
-			"x#device-code": {"pending_login": {"device_code": "device-code", "user_code": "WDJBMJHT"}}
+			"x": {"access_token": "abc", "expiry": "0001-01-01T00:00:00Z"}
+		},
+		"pending_logins": {
+			"x": {"device_code": "device-code", "user_code": "WDJBMJHT"}
 		}
 	}`, string(raw))
+
+	require.NoError(t, pendingLogins.DeletePendingLogin("x"))
+	require.NoError(t, pendingLogins.DeletePendingLogin("y"))
+	_, err = pendingLogins.LookupPendingLogin("x")
+	assert.ErrorIs(t, err, ErrNotFound)
+	got, err = c.Lookup("x")
+	require.NoError(t, err)
+	assert.Equal(t, "abc", got.Token.AccessToken)
 }
 
 func TestNoStoreFileReturnsErrNotConfigured(t *testing.T) {
diff --git a/libs/auth/storage/keyring.go b/libs/auth/storage/keyring.go
index 1beccdca3e5..894d9dc9832 100644
--- a/libs/auth/storage/keyring.go
+++ b/libs/auth/storage/keyring.go
@@ -17,6 +17,10 @@ import (
 // cache key the U2M manager passes through Store.Put / Lookup.
 const keyringServiceName = "databricks-cli"
 
+// pendingLoginServiceName is the keyring service under which pending logins
+// are stored. It keeps them apart from the tokens under keyringServiceName.
+const pendingLoginServiceName = "databricks-cli-pending-login"
+
 // keyringProbeAccountPrefix is prefixed onto a per-call random suffix to form
 // the account name ProbeKeyring writes and deletes. A fixed name like
 // "__probe__" could collide with a user profile of the same name (which is
@@ -47,8 +51,7 @@ type keyringBackend interface {
 // checksum, store time, ...) without breaking older CLI versions that read
 // the same entry.
 type keyringEntry struct {
-	Token        *oauth2.Token `json:"token"`
-	PendingLogin *PendingLogin `json:"pending_login,omitempty"`
+	Token *oauth2.Token `json:"token"`
 }
 
 // zalandoBackend delegates to the process-wide zalando/go-keyring provider.
@@ -169,9 +172,60 @@ func (k *keyringStore) Delete(key string) error {
 
 // Lookup implements the Store interface, returning ErrNotFound on a miss.
 func (k *keyringStore) Lookup(key string) (Entry, error) {
+	raw, err := k.get(k.keyringSvcName, key)
+	if err != nil {
+		return Entry{}, err
+	}
+
+	var entry keyringEntry
+	if err := json.Unmarshal([]byte(raw), &entry); err != nil {
+		return Entry{}, fmt.Errorf("unmarshal token: %w", err)
+	}
+	return Entry(entry), nil
+}
+
+// PutPendingLogin implements the PendingLoginStore interface.
+func (k *keyringStore) PutPendingLogin(key string, p PendingLogin) error {
+	raw, err := json.Marshal(p)
+	if err != nil {
+		return fmt.Errorf("marshal pending login: %w", err)
+	}
+	return k.withTimeout("set", func() error {
+		return k.backend.Set(pendingLoginServiceName, key, string(raw))
+	})
+}
+
+// LookupPendingLogin implements the PendingLoginStore interface, returning
+// ErrNotFound on a miss.
+func (k *keyringStore) LookupPendingLogin(key string) (PendingLogin, error) {
+	raw, err := k.get(pendingLoginServiceName, key)
+	if err != nil {
+		return PendingLogin{}, err
+	}
+	var p PendingLogin
+	if err := json.Unmarshal([]byte(raw), &p); err != nil {
+		return PendingLogin{}, fmt.Errorf("unmarshal pending login: %w", err)
+	}
+	return p, nil
+}
+
+// DeletePendingLogin implements the PendingLoginStore interface. Removing a
+// missing pending login is a no-op.
+func (k *keyringStore) DeletePendingLogin(key string) error {
+	return k.withTimeout("delete", func() error {
+		err := k.backend.Delete(pendingLoginServiceName, key)
+		if errors.Is(err, keyring.ErrNotFound) {
+			return nil
+		}
+		return err
+	})
+}
+
+// get returns the secret stored under key in service, or ErrNotFound.
+func (k *keyringStore) get(service, key string) (string, error) {
 	var raw string
 	err := k.withTimeout("get", func() error {
-		got, gerr := k.backend.Get(k.keyringSvcName, key)
+		got, gerr := k.backend.Get(service, key)
 		if gerr != nil {
 			return gerr
 		}
@@ -179,17 +233,12 @@ func (k *keyringStore) Lookup(key string) (Entry, error) {
 		return nil
 	})
 	if errors.Is(err, keyring.ErrNotFound) {
-		return Entry{}, ErrNotFound
+		return "", ErrNotFound
 	}
 	if err != nil {
-		return Entry{}, wrapKeyringUnreachable(err)
+		return "", wrapKeyringUnreachable(err)
 	}
-
-	var entry keyringEntry
-	if err := json.Unmarshal([]byte(raw), &entry); err != nil {
-		return Entry{}, fmt.Errorf("unmarshal token: %w", err)
-	}
-	return Entry(entry), nil
+	return raw, nil
 }
 
 // wrapKeyringUnreachable wraps a non-ErrNotFound keyring error with
@@ -210,8 +259,11 @@ func wrapKeyringUnreachable(err error) error {
 	return fmt.Errorf("OS keyring unreachable: %w (set DATABRICKS_AUTH_STORAGE=plaintext or run `databricks auth login` to use file-based token storage)", err)
 }
 
-// Compile-time confirmation that keyringStore satisfies the CLI interface.
-var _ Store = (*keyringStore)(nil)
+// Compile-time confirmation that keyringStore satisfies the CLI interfaces.
+var (
+	_ Store             = (*keyringStore)(nil)
+	_ PendingLoginStore = (*keyringStore)(nil)
+)
 
 // TimeoutError is returned when a keyring operation exceeds the configured
 // timeout. Callers can use errors.As to detect and present a clear message.
diff --git a/libs/auth/storage/keyring_test.go b/libs/auth/storage/keyring_test.go
index 77a7ced4779..bf38943844e 100644
--- a/libs/auth/storage/keyring_test.go
+++ b/libs/auth/storage/keyring_test.go
@@ -118,17 +118,27 @@ func TestKeyringStore_Lookup_ReturnsStoredToken(t *testing.T) {
 	assert.Equal(t, "Bearer", got.Token.TokenType)
 }
 
-func TestKeyringStore_Lookup_ReturnsStoredPendingLogin(t *testing.T) {
+func TestKeyringStore_PendingLoginIsApartFromTokens(t *testing.T) {
 	backend := newFakeBackend()
 	c := newTestStore(backend)
+	pending := PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
+	require.NoError(t, c.Put("my-profile", Entry{Token: &oauth2.Token{AccessToken: "abc"}}))
+	require.NoError(t, c.PutPendingLogin("my-profile", pending))
 
-	want := &PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
-	require.NoError(t, c.Put("my-profile#device-code", Entry{PendingLogin: want}))
-
-	got, err := c.Lookup("my-profile#device-code")
+	got, err := c.Lookup("my-profile")
 	require.NoError(t, err)
-	assert.Nil(t, got.Token)
-	assert.Equal(t, want, got.PendingLogin)
+	assert.Equal(t, "abc", got.Token.AccessToken)
+	gotPending, err := c.LookupPendingLogin("my-profile")
+	require.NoError(t, err)
+	assert.Equal(t, pending, gotPending)
+	assert.Contains(t, backend.items, itemKey(pendingLoginServiceName, "my-profile"))
+
+	require.NoError(t, c.DeletePendingLogin("my-profile"))
+	require.NoError(t, c.DeletePendingLogin("my-profile"))
+	_, err = c.LookupPendingLogin("my-profile")
+	assert.ErrorIs(t, err, ErrNotFound)
+	_, err = c.Lookup("my-profile")
+	assert.NoError(t, err)
 }
 
 func TestKeyringStore_Lookup_MissingReturnsCacheErrNotFound(t *testing.T) {
diff --git a/libs/auth/storage/memory.go b/libs/auth/storage/memory.go
index d639cf5f108..777fdac27df 100644
--- a/libs/auth/storage/memory.go
+++ b/libs/auth/storage/memory.go
@@ -11,12 +11,13 @@ import (
 // default store used by PersistentAuth when no WithTokenStore option is
 // provided. Most production consumers should supply a persistent Store.
 func NewMemoryStore() Store {
-	return &memoryStore{entries: map[string]Entry{}}
+	return &memoryStore{entries: map[string]Entry{}, pendingLogins: map[string]PendingLogin{}}
 }
 
 type memoryStore struct {
-	mu      sync.Mutex
-	entries map[string]Entry
+	mu            sync.Mutex
+	entries       map[string]Entry
+	pendingLogins map[string]PendingLogin
 }
 
 func cloneToken(t *oauth2.Token) *oauth2.Token {
@@ -29,10 +30,6 @@ func cloneToken(t *oauth2.Token) *oauth2.Token {
 
 func cloneEntry(e Entry) Entry {
 	e.Token = cloneToken(e.Token)
-	if e.PendingLogin != nil {
-		pending := *e.PendingLogin
-		e.PendingLogin = &pending
-	}
 	return e
 }
 
@@ -62,3 +59,34 @@ func (s *memoryStore) Delete(key string) error {
 	delete(s.entries, key)
 	return nil
 }
+
+// PutPendingLogin implements PendingLoginStore.
+func (s *memoryStore) PutPendingLogin(key string, p PendingLogin) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.pendingLogins[key] = p
+	return nil
+}
+
+// LookupPendingLogin implements PendingLoginStore. Returns ErrNotFound when
+// the key is absent.
+func (s *memoryStore) LookupPendingLogin(key string) (PendingLogin, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	p, ok := s.pendingLogins[key]
+	if !ok {
+		return PendingLogin{}, ErrNotFound
+	}
+	return p, nil
+}
+
+// DeletePendingLogin implements PendingLoginStore.
+func (s *memoryStore) DeletePendingLogin(key string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.pendingLogins, key)
+	return nil
+}
+
+// Compile-time confirmation that memoryStore keeps pending logins.
+var _ PendingLoginStore = (*memoryStore)(nil)
diff --git a/libs/auth/storage/memory_test.go b/libs/auth/storage/memory_test.go
index 2a28d9b197a..e3ff27bcd1c 100644
--- a/libs/auth/storage/memory_test.go
+++ b/libs/auth/storage/memory_test.go
@@ -57,16 +57,25 @@ func TestMemoryStore_PutAndLookupUseCopies(t *testing.T) {
 	}
 }
 
-func TestMemoryStore_PendingLoginUsesCopies(t *testing.T) {
+func TestMemoryStore_PendingLoginIsApartFromTokens(t *testing.T) {
 	s := NewMemoryStore()
-	pending := &PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
-	require.NoError(t, s.Put("key1", Entry{PendingLogin: pending}))
-
-	pending.DeviceCode = "mutated-after-store"
+	pendingLogins := s.(PendingLoginStore)
+	pending := PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
+	require.NoError(t, s.Put("key1", Entry{Token: &oauth2.Token{AccessToken: "abc"}}))
+	require.NoError(t, pendingLogins.PutPendingLogin("key1", pending))
 
 	got, err := s.Lookup("key1")
 	require.NoError(t, err)
-	assert.Equal(t, "device-code", got.PendingLogin.DeviceCode)
+	assert.Equal(t, "abc", got.Token.AccessToken)
+	gotPending, err := pendingLogins.LookupPendingLogin("key1")
+	require.NoError(t, err)
+	assert.Equal(t, pending, gotPending)
+
+	require.NoError(t, pendingLogins.DeletePendingLogin("key1"))
+	_, err = pendingLogins.LookupPendingLogin("key1")
+	assert.ErrorIs(t, err, ErrNotFound)
+	_, err = s.Lookup("key1")
+	assert.NoError(t, err)
 }
 
 func TestMemoryStore_Delete(t *testing.T) {
diff --git a/libs/auth/storage/storage.go b/libs/auth/storage/storage.go
index 90253c55dcb..027b29ad3b2 100644
--- a/libs/auth/storage/storage.go
+++ b/libs/auth/storage/storage.go
@@ -24,18 +24,13 @@ var ErrNotFound = errors.New("token not found")
 // without changing the Store interface. Backends persist it verbatim and never
 // interpret its contents.
 type Entry struct {
-	// Token is the cached OAuth token. Set for every stored entry except a
-	// pending login.
+	// Token is the cached OAuth token. Always set for stored entries.
 	Token *oauth2.Token
-
-	// PendingLogin is set instead of Token for a login that one CLI
-	// invocation started and a later one completes.
-	PendingLogin *PendingLogin
 }
 
-// PendingLogin is a device code login that is waiting for the user's
-// confirmation code. Keeping the device code in the store means it never
-// leaves the machine that started the login.
+// PendingLogin is a device code login that one CLI invocation started and a
+// later one completes once the user has the confirmation code. Keeping the
+// device code in the store means it is never printed.
 type PendingLogin struct {
 	// DeviceCode is exchanged together with the confirmation code for a token.
 	DeviceCode string `json:"device_code"`
@@ -45,6 +40,24 @@ type PendingLogin struct {
 	UserCode string `json:"user_code"`
 }
 
+// PendingLoginStore holds pending logins. The file, keyring and memory stores
+// implement it next to Store and keep pending logins apart from the tokens,
+// so that a pending login can neither replace a token nor be read as one,
+// whatever a profile is named.
+type PendingLoginStore interface {
+	// PutPendingLogin writes p under key, replacing any existing pending
+	// login.
+	PutPendingLogin(key string, p PendingLogin) error
+
+	// LookupPendingLogin returns the pending login stored under key, or
+	// ErrNotFound.
+	LookupPendingLogin(key string) (PendingLogin, error)
+
+	// DeletePendingLogin removes the pending login under key. Deleting a
+	// missing pending login is not an error.
+	DeletePendingLogin(key string) error
+}
+
 // Store is the CLI's token-storage abstraction: a key/value store with no
 // policy of its own. Implementations are the plaintext file cache and the OS
 // keyring and in-memory stores. The entry schema can evolve with additive

From 77faedacb84a4f48b98bcf1501333101f577b1c5 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Thu, 29 Oct 2026 15:33:42 +0000
Subject: [PATCH 10/29] Complete a device code login only with the settings
 that started it

The second step of the non-interactive login used the host, --client-id
and --scopes of its own command. The token gets the scopes of the device
authorization, so a second step without the --scopes of the first saved a
profile whose scopes did not match its token, and a different host or
client sent the device code to a server or for a client that did not
issue it.

The pending login now stores the host, client ID and scopes, and the second
step fails before the token exchange if any of them differs.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 .../non-interactive/errors/output.txt         |  8 +++
 .../device-code/non-interactive/errors/script |  6 ++
 cmd/auth/README.md                            |  6 +-
 cmd/auth/login.go                             |  2 +
 cmd/auth/login_device_code.go                 | 23 ++++++++
 cmd/auth/login_device_code_test.go            | 58 +++++++++++++++++++
 docs/device-code-login.md                     |  1 +
 libs/auth/storage/filestore_test.go           |  9 ++-
 libs/auth/storage/storage.go                  |  8 +++
 9 files changed, 118 insertions(+), 3 deletions(-)

diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
index d397d2cd99d..61779755d01 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
@@ -85,9 +85,17 @@ Error: token exchange: Invalid device code (error code: invalid_request). Run th
   ]
 }
 
+=== Scopes changed between the steps
+
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --scopes sql
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+Error: the login for profile test was started with different scopes. Complete it with the same command that started it. Run the same command without --user-code and --confirmation-code to start a new login
+
 >>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
 {"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
 {"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=AAAAAAAA&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
 {"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
 {"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
 {"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=unknown-device-code&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
+{"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+sql"}
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/errors/script b/acceptance/cmd/auth/login/device-code/non-interactive/errors/script
index 15a8010930f..69517fddaf2 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/errors/script
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/errors/script
@@ -53,4 +53,10 @@ trace update_file.py home/.databricks/token-cache.json device-code-2 unknown-dev
 trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
 trace cache_keys
 
+# The token gets the scopes of the device authorization, so the second step
+# cannot change them.
+title "Scopes changed between the steps\n"
+start_login LOG.scopes $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --scopes sql
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+
 trace print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
diff --git a/cmd/auth/README.md b/cmd/auth/README.md
index 80a62b50076..53d1cdc022d 100644
--- a/cmd/auth/README.md
+++ b/cmd/auth/README.md
@@ -134,7 +134,11 @@ from, e.g., an agent's transcript cannot complete the login on another machine.
 
 Each target has one pending login, and a new login for it replaces the old
 one. The second step checks the user code, so a replaced login fails with a
-clear error without sending its confirmation code. A wrong confirmation code
+clear error without sending its confirmation code. It also checks the host,
+client ID and scopes that the pending login stores: the device code only works
+with the same host and client, and the token gets the scopes of the device
+authorization, so a profile saved with other settings would not match its
+token. A wrong confirmation code
 keeps the pending login for a rerun. A device code the server no longer knows
 deletes it, and so does any successful login for the same target
 (`storeLoginToken`), with or without device code. The CLI does not expire
diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index 800790d558f..593aeafeabc 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -476,6 +476,8 @@ a new profile is created.
 			key:            oauthArgument.GetCacheKey(),
 			profile:        profileName,
 			host:           authArguments.Host,
+			clientID:       clientID,
+			scopes:         scopesList,
 		}
 		var token *oauth2.Token
 		switch {
diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index 7bff6d78d16..7a5ab6fb68b 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"slices"
 	"strings"
 
 	"github.com/databricks/cli/libs/auth/storage"
@@ -137,6 +138,8 @@ type nonInteractiveDeviceCodeLogin struct {
 	key            string
 	profile        string
 	host           string
+	clientID       string
+	scopes         []string
 }
 
 // pendingLoginStore returns the pending logins that tokenStore keeps apart
@@ -187,6 +190,9 @@ func (l nonInteractiveDeviceCodeLogin) start(ctx context.Context) error {
 	err = pendingLogins.PutPendingLogin(l.key, storage.PendingLogin{
 		DeviceCode: da.DeviceCode,
 		UserCode:   da.UserCode,
+		Host:       l.host,
+		ClientID:   l.clientID,
+		Scopes:     l.scopes,
 	})
 	if err != nil {
 		return fmt.Errorf("store pending login: %w", err)
@@ -220,6 +226,9 @@ func (l nonInteractiveDeviceCodeLogin) complete(ctx context.Context, userCode, c
 	if !sameCode(pending.UserCode, userCode) {
 		return nil, fmt.Errorf("a newer login for %s replaced this one. Complete the newer login with its user code. %s", l.target(), startNewLoginHint)
 	}
+	if changed := l.changedSetting(pending); changed != "" {
+		return nil, fmt.Errorf("the login for %s was started with %s. Complete it with the same command that started it. %s", l.target(), changed, startNewLoginHint)
+	}
 
 	login, err := l.persistentAuth.NewDeviceCodeLogin(ctx)
 	if err != nil {
@@ -247,6 +256,20 @@ func (l nonInteractiveDeviceCodeLogin) complete(ctx context.Context, userCode, c
 	return token, err
 }
 
+// changedSetting describes the setting that differs from the one pending was
+// started with, or returns "" if none does.
+func (l nonInteractiveDeviceCodeLogin) changedSetting(pending storage.PendingLogin) string {
+	switch {
+	case pending.Host != l.host:
+		return "a different host"
+	case pending.ClientID != l.clientID:
+		return "a different client ID"
+	case !slices.Equal(pending.Scopes, l.scopes):
+		return "different scopes"
+	}
+	return ""
+}
+
 // sameCode reports whether two device codes match when compared the way the
 // user enters them.
 func sameCode(a, b string) bool {
diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index eadc259729c..04244727e01 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -532,6 +532,64 @@ func TestLoginDeviceCodeCompletionChecksUserCode(t *testing.T) {
 	assert.Equal(t, int32(1), tokenRequests.Load())
 }
 
+func TestLoginDeviceCodeCompletionChecksSettings(t *testing.T) {
+	tests := []struct {
+		name string
+		// startArgs and completeArgs are added to the flags of each step.
+		startArgs    []string
+		completeArgs []string
+		// completeOnOtherHost completes the login on a second server.
+		completeOnOtherHost bool
+		wantChanged         string
+	}{
+		{
+			name:                "host",
+			completeOnOtherHost: true,
+			wantChanged:         "a different host",
+		},
+		{
+			name:         "client ID",
+			completeArgs: []string{"--client-id", "other-client"},
+			wantChanged:  "a different client ID",
+		},
+		{
+			name:        "scopes dropped",
+			startArgs:   []string{"--scopes", "sql"},
+			wantChanged: "different scopes",
+		},
+		{
+			name:         "scopes added",
+			completeArgs: []string{"--scopes", "sql"},
+			wantChanged:  "different scopes",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			server := newDeviceCodeServer(t)
+			var tokenRequests atomic.Int32
+			server.RequestCallback = func(req *testserver.Request) {
+				if req.URL.Path == "/oidc/v1/token" {
+					tokenRequests.Add(1)
+				}
+			}
+			setUpDeviceCodeLogin(t, "")
+			ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), flags.OutputText, strings.NewReader(""), &bytes.Buffer{}, &bytes.Buffer{}, "", ""))
+			require.NoError(t, runDeviceCodeLogin(ctx, append([]string{"--host", server.URL, "--profile", "test"}, tt.startArgs...)...))
+
+			host := server.URL
+			if tt.completeOnOtherHost {
+				other := newDeviceCodeServer(t)
+				other.RequestCallback = server.RequestCallback
+				host = other.URL
+			}
+			args := append([]string{"--host", host, "--profile", "test", "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY"}, tt.completeArgs...)
+			err := runDeviceCodeLogin(ctx, args...)
+			assert.EqualError(t, err, "the login for profile test was started with "+tt.wantChanged+". Complete it with the same command that started it. "+startNewLoginHint)
+			assert.Zero(t, tokenRequests.Load())
+		})
+	}
+}
+
 func TestLoginDeviceCodeCompletionWithoutHostSkipsPicker(t *testing.T) {
 	tm := startDeviceCodeLogin(t, "", "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY")
 	_, err := tm.Result()
diff --git a/docs/device-code-login.md b/docs/device-code-login.md
index fab9ac4614e..27e16ff37eb 100644
--- a/docs/device-code-login.md
+++ b/docs/device-code-login.md
@@ -123,6 +123,7 @@ fail with a token refresh error and you need to run the login again.
 | `token exchange: Invalid confirmation code (error code: invalid_request). Check the confirmation code ...` | The confirmation code was mistyped, or the login was not approved yet. | Check the code and approve the login, then run the command again. If it still fails, start a new login. |
 | `token exchange: Invalid device code (error code: invalid_request). Run the same command without --user-code and --confirmation-code ...` | The login expired. | Start a new login. |
 | `a newer login for profile ... replaced this one` | A second login was started for the same profile or host. | Approve the newest code, and complete the newest login with its user code. |
+| `the login for profile ... was started with a different host` (or client ID, or scopes) | The second command does not use the host, `--client-id` or `--scopes` of the first one. | Complete the login with the same command that started it, plus `--user-code` and `--confirmation-code`. |
 | `no pending device code login for profile ...` | The login was already completed, or no login was started for this profile or host. | Start a new login. |
 | `--confirmation-code requires --user-code` | `--user-code` is missing from the command. | Add `--user-code` with the code from the first step. |
 | `--confirmation-code requires --use-device-code` | `--use-device-code` is missing from the command. | Run the same command as the first step, with `--user-code` and `--confirmation-code`. |
diff --git a/libs/auth/storage/filestore_test.go b/libs/auth/storage/filestore_test.go
index 8752cf606b9..37e10908ed3 100644
--- a/libs/auth/storage/filestore_test.go
+++ b/libs/auth/storage/filestore_test.go
@@ -41,7 +41,12 @@ func TestPendingLoginIsApartFromTokens(t *testing.T) {
 	c, err := NewFileStore(t.Context(), WithFileLocation(f))
 	require.NoError(t, err)
 	pendingLogins := c.(PendingLoginStore)
-	pending := PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
+	pending := PendingLogin{
+		DeviceCode: "device-code",
+		UserCode:   "WDJBMJHT",
+		Host:       "https://workspace.test",
+		Scopes:     []string{"sql"},
+	}
 	require.NoError(t, c.Put("x", Entry{Token: &oauth2.Token{AccessToken: "abc"}}))
 	require.NoError(t, pendingLogins.PutPendingLogin("x", pending))
 
@@ -62,7 +67,7 @@ func TestPendingLoginIsApartFromTokens(t *testing.T) {
 			"x": {"access_token": "abc", "expiry": "0001-01-01T00:00:00Z"}
 		},
 		"pending_logins": {
-			"x": {"device_code": "device-code", "user_code": "WDJBMJHT"}
+			"x": {"device_code": "device-code", "user_code": "WDJBMJHT", "host": "https://workspace.test", "scopes": ["sql"]}
 		}
 	}`, string(raw))
 
diff --git a/libs/auth/storage/storage.go b/libs/auth/storage/storage.go
index 027b29ad3b2..43eaaaf15c5 100644
--- a/libs/auth/storage/storage.go
+++ b/libs/auth/storage/storage.go
@@ -38,6 +38,14 @@ type PendingLogin struct {
 	// UserCode is the code the user enters in the browser. It identifies the
 	// login when a newer one replaced it under the same key.
 	UserCode string `json:"user_code"`
+
+	// Host, ClientID and Scopes are the settings the login was started with.
+	// The device code only works with the same host and client, and the
+	// token gets the scopes of the device authorization, so the login can
+	// only be completed with the same settings.
+	Host     string   `json:"host"`
+	ClientID string   `json:"client_id,omitempty"`
+	Scopes   []string `json:"scopes,omitempty"`
 }
 
 // PendingLoginStore holds pending logins. The file, keyring and memory stores

From e3c67b7cf26f5b98e1dd7c69022fa11a469a0361 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Thu, 29 Oct 2026 15:37:42 +0000
Subject: [PATCH 11/29] Skip the workspace picker in the non-interactive device
 code login

The second step of the non-interactive login asked for the workspace when
it ran in a terminal and the host had an account ID but no workspace ID,
although neither step is meant to prompt. It now shows the hint that a
login without a terminal shows instead, and saves the profile without a
workspace ID.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/login.go                  | 13 +++++++++--
 cmd/auth/login_device_code_test.go | 37 ++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 2 deletions(-)

diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index 593aeafeabc..feabd399918 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -79,6 +79,9 @@ const (
 	// deviceCodeEnvVar enables the experimental device code login flow
 	// (--use-device-code) while it is experimental.
 	deviceCodeEnvVar = "DATABRICKS_CLI_DEVICE_CODE"
+	// workspaceIDHint is shown instead of the workspace picker when login
+	// cannot prompt.
+	workspaceIDHint = "To use workspace commands, set workspace_id in your profile or pass --workspace-id."
 )
 
 // discoveryErr wraps an error (or creates a new one) and appends the
@@ -501,7 +504,13 @@ a new profile is created.
 		// 2. Configuring cluster and serverless;
 		// 3. Saving the profile.
 
-		if shouldPromptWorkspace(authArguments, existingProfile, skipWorkspace) {
+		promptWorkspace := shouldPromptWorkspace(authArguments, existingProfile, skipWorkspace)
+		switch {
+		case promptWorkspace && nonInteractive:
+			// The non-interactive device code login does not prompt, even in
+			// a terminal.
+			cmdio.LogString(ctx, workspaceIDHint)
+		case promptWorkspace:
 			wsID, wsErr := promptForWorkspaceSelection(ctx, authArguments, tokenSource)
 			if wsErr != nil {
 				log.Warnf(ctx, "Workspace selection failed: %v", wsErr)
@@ -1016,7 +1025,7 @@ func u2mResourcesFromProfile(p *profile.Profile) []string {
 // to the user.
 func promptForWorkspaceSelection(ctx context.Context, authArguments *auth.AuthArguments, tokenSource oauth2.TokenSource) (string, error) {
 	if !cmdio.IsPromptSupported(ctx) {
-		cmdio.LogString(ctx, "To use workspace commands, set workspace_id in your profile or pass --workspace-id.")
+		cmdio.LogString(ctx, workspaceIDHint)
 		return "", nil
 	}
 
diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index 04244727e01..f69df01612b 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -5,8 +5,11 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"net/http"
+	"net/http/httptest"
+	"net/http/httputil"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -510,6 +513,40 @@ func TestLoginDeviceCodeCompletesInTerminal(t *testing.T) {
 // A user code that does not match the pending login fails before the token
 // exchange, so the confirmation code is not sent with the device code of
 // another login.
+func TestLoginDeviceCodeCompletionInTerminalSkipsWorkspacePicker(t *testing.T) {
+	backend := newDeviceCodeServer(t)
+	backendURL, err := url.Parse(backend.URL)
+	require.NoError(t, err)
+	// The host metadata of the fake server has a workspace ID, which skips the
+	// workspace picker. Without it, login with an account ID asks for the
+	// workspace.
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/.well-known/databricks-config" {
+			fmt.Fprintf(w, `{"oidc_endpoint": %q}`, backend.URL+"/oidc")
+			return
+		}
+		httputil.NewSingleHostReverseProxy(backendURL).ServeHTTP(w, r)
+	}))
+	t.Cleanup(server.Close)
+	setUpDeviceCodeLogin(t, "")
+	host := server.URL + "?a=123"
+	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), flags.OutputText, strings.NewReader(""), &bytes.Buffer{}, &bytes.Buffer{}, "", ""))
+	require.NoError(t, runDeviceCodeLogin(ctx, "--host", host, "--profile", "test"))
+
+	tm := termtest.Run(t, func(ctx context.Context) (struct{}, error) {
+		return struct{}{}, runDeviceCodeLogin(ctx, "--host", host, "--profile", "test", "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY")
+	})
+	tm.WaitFor(workspaceIDHint)
+	_, err = tm.Result()
+	require.NoError(t, err)
+
+	profiles, err := profile.DefaultProfiler.LoadProfiles(t.Context(), profile.WithName("test"))
+	require.NoError(t, err)
+	require.Len(t, profiles, 1)
+	assert.Equal(t, "123", profiles[0].AccountID)
+	assert.Empty(t, profiles[0].WorkspaceID)
+}
+
 func TestLoginDeviceCodeCompletionChecksUserCode(t *testing.T) {
 	server := newDeviceCodeServer(t)
 	var tokenRequests atomic.Int32

From 43207faadd9a717580a1f280266a8cc763b36cda Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Thu, 29 Oct 2026 16:07:36 +0000
Subject: [PATCH 12/29] Revert "Keep pending device code logins apart from the
 tokens"

This reverts commit 1af032a8d. Pending logins are token store entries
under the cache key with a #device-code suffix again, and keep the host,
client ID and scopes that a later commit added. The README describes the
settings check in its own paragraph.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 .../non-interactive/concurrent/output.txt     | 42 ++++------
 .../non-interactive/errors/output.txt         | 11 +--
 .../non-interactive/nominal/output.txt        | 29 +++----
 .../non-interactive/script.prepare            |  5 +-
 .../pending-device-code-login/output.txt      | 21 ++---
 .../logout/pending-device-code-login/script   | 14 ++--
 cmd/auth/README.md                            | 22 +++---
 cmd/auth/login.go                             | 12 +--
 cmd/auth/login_device_code.go                 | 59 ++++++--------
 cmd/auth/login_device_code_test.go            |  5 +-
 cmd/auth/login_test.go                        | 14 ++--
 cmd/auth/logout.go                            |  4 +-
 libs/auth/storage/filestore.go                | 66 +---------------
 libs/auth/storage/filestore_test.go           | 31 ++------
 libs/auth/storage/keyring.go                  | 78 ++++---------------
 libs/auth/storage/keyring_test.go             | 24 ++----
 libs/auth/storage/memory.go                   | 42 ++--------
 libs/auth/storage/memory_test.go              | 21 ++---
 libs/auth/storage/storage.go                  | 31 +++-----
 19 files changed, 144 insertions(+), 387 deletions(-)

diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt
index 05c73211e72..641900bd214 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt
@@ -8,12 +8,9 @@
 >>> update_file.py home/.databricks/token-cache.json WDJBMJHT NEWRCODE
 
 >>> cache_keys
-{
-  "pending_logins": [
-    "test"
-  ],
-  "tokens": []
-}
+[
+  "test#device-code"
+]
 
 >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
 Error: a newer login for profile test replaced this one. Complete the newer login with its user code. Run the same command without --user-code and --confirmation-code to start a new login
@@ -33,17 +30,13 @@ Profile test was successfully saved
 >>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code
 
 >>> cache_keys
-{
-  "pending_logins": [
-    "a",
-    "b",
-    "[DATABRICKS_URL]"
-  ],
-  "tokens": [
-    "[DATABRICKS_URL]",
-    "test"
-  ]
-}
+[
+  "a#device-code",
+  "b#device-code",
+  "[DATABRICKS_URL]",
+  "[DATABRICKS_URL]#device-code",
+  "test"
+]
 
 >>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
 Profile b was successfully saved
@@ -54,15 +47,12 @@ Profile b was successfully saved
 Profile a was successfully saved
 
 >>> cache_keys
-{
-  "pending_logins": [],
-  "tokens": [
-    "a",
-    "b",
-    "[DATABRICKS_URL]",
-    "test"
-  ]
-}
+[
+  "a",
+  "b",
+  "[DATABRICKS_URL]",
+  "test"
+]
 
 >>> print_requests.py --oneline //oidc/v1/token
 {"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-4&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
index 61779755d01..e293a7f47c2 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
@@ -77,13 +77,10 @@ Error: no pending device code login for profile test. Run the same command witho
 Error: token exchange: Invalid device code (error code: invalid_request). Run the same command without --user-code and --confirmation-code to start a new login
 
 >>> cache_keys
-{
-  "pending_logins": [],
-  "tokens": [
-    "[DATABRICKS_URL]",
-    "test"
-  ]
-}
+[
+  "[DATABRICKS_URL]",
+  "test"
+]
 
 === Scopes changed between the steps
 
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt
index 08e8fffdcac..5a70dc2fd0c 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt
@@ -18,12 +18,9 @@ provided in your browser.
 home/.databricks/token-cache.json
 
 >>> cache_keys
-{
-  "pending_logins": [
-    "[DATABRICKS_URL]"
-  ],
-  "tokens": []
-}
+[
+  "[DATABRICKS_URL]#device-code"
+]
 
 === Confirm the login
 
@@ -33,12 +30,9 @@ home/.databricks/token-cache.json
 json.access_token = "oauth-token";
 
 >>> cache_keys
-{
-  "pending_logins": [],
-  "tokens": [
-    "[DATABRICKS_URL]"
-  ]
-}
+[
+  "[DATABRICKS_URL]"
+]
 
 === Start the login with a profile
 
@@ -85,13 +79,10 @@ json.access_token = "oauth-token";
 Profile test was successfully saved
 
 >>> cache_keys
-{
-  "pending_logins": [],
-  "tokens": [
-    "[DATABRICKS_URL]",
-    "test"
-  ]
-}
+[
+  "[DATABRICKS_URL]",
+  "test"
+]
 
 >>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
 {"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/script.prepare b/acceptance/cmd/auth/login/device-code/non-interactive/script.prepare
index bc62f4668ad..447c920c748 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/script.prepare
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/script.prepare
@@ -1,7 +1,6 @@
-# cache_keys lists the keys of the tokens and of the pending logins in the
-# plaintext token cache.
+# cache_keys lists the keys in the plaintext token cache.
 cache_keys() {
-    jq -S '{tokens: (.tokens | keys), pending_logins: (.pending_logins // {} | keys)}' "./home/.databricks/token-cache.json"
+    jq -S '.tokens | keys' "./home/.databricks/token-cache.json"
 }
 
 # start_login traces the first step in "$@" and saves its output to file $1,
diff --git a/acceptance/cmd/auth/logout/pending-device-code-login/output.txt b/acceptance/cmd/auth/logout/pending-device-code-login/output.txt
index 0cfa26a0164..b347f1321d4 100644
--- a/acceptance/cmd/auth/logout/pending-device-code-login/output.txt
+++ b/acceptance/cmd/auth/logout/pending-device-code-login/output.txt
@@ -4,23 +4,16 @@
 Logged out of and deleted profile "dev".
 
 === Token cache keys after logout — the host keys are kept, staging shares them
-{
-  "pending_logins": [
-    "[DATABRICKS_URL]",
-    "staging"
-  ],
-  "tokens": [
-    "[DATABRICKS_URL]",
-    "staging"
-  ]
-}
+[
+  "[DATABRICKS_URL]",
+  "[DATABRICKS_URL]#device-code",
+  "staging",
+  "staging#device-code"
+]
 
 === Logout staging
 >>> [CLI] auth logout --profile staging --auto-approve
 Logged out of profile "staging". Use --delete to also remove it from the config file.
 
 === Token cache keys after logout — no profile uses the host anymore
-{
-  "pending_logins": [],
-  "tokens": []
-}
+[]
diff --git a/acceptance/cmd/auth/logout/pending-device-code-login/script b/acceptance/cmd/auth/logout/pending-device-code-login/script
index cc19983f002..1d62f2cb572 100644
--- a/acceptance/cmd/auth/logout/pending-device-code-login/script
+++ b/acceptance/cmd/auth/logout/pending-device-code-login/script
@@ -16,13 +16,11 @@ cat > "./home/.databricks/token-cache.json" <<EOF
   "version": 1,
   "tokens": {
     "dev": {"access_token": "dev-cached-token", "token_type": "Bearer"},
+    "dev#device-code": {"pending_login": {"device_code": "dev-device-code", "user_code": "WDJBMJHT"}},
     "staging": {"access_token": "staging-cached-token", "token_type": "Bearer"},
-    "${DATABRICKS_HOST}": {"access_token": "shared-host-token", "token_type": "Bearer"}
-  },
-  "pending_logins": {
-    "dev": {"device_code": "dev-device-code", "user_code": "WDJBMJHT"},
-    "staging": {"device_code": "staging-device-code", "user_code": "WDJBMJHT"},
-    "${DATABRICKS_HOST}": {"device_code": "host-device-code", "user_code": "WDJBMJHT"}
+    "staging#device-code": {"pending_login": {"device_code": "staging-device-code", "user_code": "WDJBMJHT"}},
+    "${DATABRICKS_HOST}": {"access_token": "shared-host-token", "token_type": "Bearer"},
+    "${DATABRICKS_HOST}#device-code": {"pending_login": {"device_code": "host-device-code", "user_code": "WDJBMJHT"}}
   }
 }
 EOF
@@ -31,10 +29,10 @@ title "Logout and delete dev"
 trace $CLI auth logout --profile dev --auto-approve --delete
 
 title "Token cache keys after logout — the host keys are kept, staging shares them\n"
-jq -S '{tokens: (.tokens | keys), pending_logins: (.pending_logins // {} | keys)}' "./home/.databricks/token-cache.json"
+jq -S '.tokens | keys' "./home/.databricks/token-cache.json"
 
 title "Logout staging"
 trace $CLI auth logout --profile staging --auto-approve
 
 title "Token cache keys after logout — no profile uses the host anymore\n"
-jq -S '{tokens: (.tokens | keys), pending_logins: (.pending_logins // {} | keys)}' "./home/.databricks/token-cache.json"
+jq -S '.tokens | keys' "./home/.databricks/token-cache.json"
diff --git a/cmd/auth/README.md b/cmd/auth/README.md
index 53d1cdc022d..a1d56b7cc5f 100644
--- a/cmd/auth/README.md
+++ b/cmd/auth/README.md
@@ -120,13 +120,10 @@ in two steps instead:
    flags exchanges the pending device code instead of requesting a new one,
    and the rest of the login runs as usual.
 
-The pending login is kept in the token store (`storage.PendingLoginStore`) under
-the login's cache key (the profile name, or the host without a profile), but
-apart from the tokens: in the `pending_logins` map of the token cache file, or
-under the `databricks-cli-pending-login` keyring service. A pending login can
-therefore neither replace a token nor be read as one, whatever a profile is
-named, and the target's current token keeps working until the login completes.
-The device code never leaves the machine;
+The pending login is a token store entry with `PendingLogin` set instead of a
+token. Its key is the login's cache key (the profile name, or the host without
+a profile) with a `#device-code` suffix, so the target's current token keeps
+working until the login completes. The device code never leaves the machine;
 only the user code and the confirmation code are printed or passed on the
 command line, and the confirmation code is useless without the device code.
 This keeps the confirmation code's protection against phishing: a code read
@@ -134,11 +131,7 @@ from, e.g., an agent's transcript cannot complete the login on another machine.
 
 Each target has one pending login, and a new login for it replaces the old
 one. The second step checks the user code, so a replaced login fails with a
-clear error without sending its confirmation code. It also checks the host,
-client ID and scopes that the pending login stores: the device code only works
-with the same host and client, and the token gets the scopes of the device
-authorization, so a profile saved with other settings would not match its
-token. A wrong confirmation code
+clear error without sending its confirmation code. A wrong confirmation code
 keeps the pending login for a rerun. A device code the server no longer knows
 deletes it, and so does any successful login for the same target
 (`storeLoginToken`), with or without device code. The CLI does not expire
@@ -146,3 +139,8 @@ pending logins itself: the server does. `auth logout` deletes the pending login
 of the profile, and the one of its host when it deletes the host's token. A
 pending login for a profile that was never saved, or for a host that no profile
 uses, stays until a new login for it replaces it.
+
+The second step also checks the host, client ID and scopes that the pending
+login stores: the device code only works with the same host and client, and the
+token gets the scopes of the device authorization, so a profile saved with
+other settings would not match its token.
diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index feabd399918..a02d427b764 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -123,20 +123,20 @@ func (d *defaultDiscoveryClient) IntrospectToken(ctx context.Context, host, acce
 // storeLoginToken persists a token after login has finished any optional
 // profile update.
 func storeLoginToken(ctx context.Context, tokenStore storage.Store, mode storage.StorageMode, arg u2m.OAuthArgument, token *oauth2.Token) error {
-	store := storage.WrapForOAuthArgument(ctx, tokenStore, mode, arg)
+	tokenStore = storage.WrapForOAuthArgument(ctx, tokenStore, mode, arg)
 	key := arg.GetCacheKey()
-	if err := store.Put(key, storage.Entry{Token: token}); err != nil {
+	if err := tokenStore.Put(key, storage.Entry{Token: token}); err != nil {
 		storeErr := fmt.Errorf("store token: %w", err)
 		// The profile is already saved, but the old token may still be present.
 		// Delete it so later commands cannot use it with the updated profile.
-		if deleteErr := store.Delete(key); deleteErr != nil {
+		if deleteErr := tokenStore.Delete(key); deleteErr != nil {
 			return errors.Join(storeErr, fmt.Errorf("delete stale token: %w", deleteErr))
 		}
 		return storeErr
 	}
 	// A pending device code login for the same profile or host is left over
-	// once a login succeeds. The wrapped store does not keep pending logins.
-	if err := deletePendingLogin(tokenStore, key); err != nil {
+	// once a login succeeds.
+	if err := tokenStore.Delete(pendingLoginKey(key)); err != nil {
 		log.Debugf(ctx, "Failed to delete the pending device code login: %v", err)
 	}
 	storage.PinSecureMode(ctx, mode, storage.StorageModeUnknown)
@@ -476,7 +476,7 @@ a new profile is created.
 		nonInteractiveLogin := nonInteractiveDeviceCodeLogin{
 			persistentAuth: persistentAuth,
 			tokenStore:     tokenStore,
-			key:            oauthArgument.GetCacheKey(),
+			key:            pendingLoginKey(oauthArgument.GetCacheKey()),
 			profile:        profileName,
 			host:           authArguments.Host,
 			clientID:       clientID,
diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index 7a5ab6fb68b..a2228c5d15d 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -21,6 +21,11 @@ import (
 // for a single device code before the login fails.
 const maxConfirmationAttempts = 3
 
+// pendingLoginKeySuffix marks the token store entry that holds a
+// non-interactive device code login until it completes. The entry sits next to
+// the login's token, so that a token that still works is kept until then.
+const pendingLoginKeySuffix = "#device-code"
+
 // startNewLoginHint ends the errors of a non-interactive device code login
 // that cannot be completed.
 const startNewLoginHint = "Run the same command without --user-code and --confirmation-code to start a new login"
@@ -130,8 +135,8 @@ func validateDeviceCodeCompletionFlags(cmd *cobra.Command, useDeviceCode bool) e
 
 // nonInteractiveDeviceCodeLogin runs the two steps of a device code login
 // that cannot read the confirmation code from stdin. The first step stores the
-// device code as a pending login under key, the cache key of the login, and the
-// second step exchanges it, so that the device code never leaves the machine.
+// device code as a pending login under key, and the second step exchanges it,
+// so that the device code never leaves the machine.
 type nonInteractiveDeviceCodeLogin struct {
 	persistentAuth *u2m.PersistentAuth
 	tokenStore     storage.Store
@@ -142,25 +147,10 @@ type nonInteractiveDeviceCodeLogin struct {
 	scopes         []string
 }
 
-// pendingLoginStore returns the pending logins that tokenStore keeps apart
-// from its tokens. The stores of storage.ResolveStore and
-// storage.ResolveStoreForLogin keep them.
-func pendingLoginStore(tokenStore storage.Store) (storage.PendingLoginStore, error) {
-	s, ok := tokenStore.(storage.PendingLoginStore)
-	if !ok {
-		return nil, fmt.Errorf("%T cannot store a pending device code login", tokenStore)
-	}
-	return s, nil
-}
-
-// deletePendingLogin deletes the pending login under key. A token store that
-// keeps no pending logins has none to delete.
-func deletePendingLogin(tokenStore storage.Store, key string) error {
-	s, ok := tokenStore.(storage.PendingLoginStore)
-	if !ok {
-		return nil
-	}
-	return s.DeletePendingLogin(key)
+// pendingLoginKey returns the token store key of the pending login for the
+// login with cacheKey.
+func pendingLoginKey(cacheKey string) string {
+	return cacheKey + pendingLoginKeySuffix
 }
 
 // target describes the login in errors.
@@ -175,10 +165,6 @@ func (l nonInteractiveDeviceCodeLogin) target() string {
 // prints how to complete the login. A pending login under the same key is
 // replaced.
 func (l nonInteractiveDeviceCodeLogin) start(ctx context.Context) error {
-	pendingLogins, err := pendingLoginStore(l.tokenStore)
-	if err != nil {
-		return err
-	}
 	login, err := l.persistentAuth.NewDeviceCodeLogin(ctx)
 	if err != nil {
 		return err
@@ -187,13 +173,13 @@ func (l nonInteractiveDeviceCodeLogin) start(ctx context.Context) error {
 	if err != nil {
 		return err
 	}
-	err = pendingLogins.PutPendingLogin(l.key, storage.PendingLogin{
+	err = l.tokenStore.Put(l.key, storage.Entry{PendingLogin: &storage.PendingLogin{
 		DeviceCode: da.DeviceCode,
 		UserCode:   da.UserCode,
 		Host:       l.host,
 		ClientID:   l.clientID,
 		Scopes:     l.scopes,
-	})
+	}})
 	if err != nil {
 		return fmt.Errorf("store pending login: %w", err)
 	}
@@ -208,17 +194,16 @@ func (l nonInteractiveDeviceCodeLogin) start(ctx context.Context) error {
 // complete exchanges the device code of the pending login started with
 // userCode together with confirmationCode for a token.
 func (l nonInteractiveDeviceCodeLogin) complete(ctx context.Context, userCode, confirmationCode string) (*oauth2.Token, error) {
-	pendingLogins, err := pendingLoginStore(l.tokenStore)
-	if err != nil {
-		return nil, err
+	e, err := l.tokenStore.Lookup(l.key)
+	if err != nil && !errors.Is(err, storage.ErrNotFound) {
+		return nil, fmt.Errorf("read pending login: %w", err)
 	}
-	pending, err := pendingLogins.LookupPendingLogin(l.key)
-	if errors.Is(err, storage.ErrNotFound) {
+	// The key can also hold the token of a profile that happens to be named
+	// like a pending login key.
+	pending := e.PendingLogin
+	if pending == nil {
 		return nil, fmt.Errorf("no pending device code login for %s. %s", l.target(), startNewLoginHint)
 	}
-	if err != nil {
-		return nil, fmt.Errorf("read pending login: %w", err)
-	}
 	// Each profile or host has one pending login, so a newer login replaces
 	// it. Checking the user code here avoids sending the confirmation code
 	// with the wrong device code, which the server would reject as a wrong
@@ -226,7 +211,7 @@ func (l nonInteractiveDeviceCodeLogin) complete(ctx context.Context, userCode, c
 	if !sameCode(pending.UserCode, userCode) {
 		return nil, fmt.Errorf("a newer login for %s replaced this one. Complete the newer login with its user code. %s", l.target(), startNewLoginHint)
 	}
-	if changed := l.changedSetting(pending); changed != "" {
+	if changed := l.changedSetting(*pending); changed != "" {
 		return nil, fmt.Errorf("the login for %s was started with %s. Complete it with the same command that started it. %s", l.target(), changed, startNewLoginHint)
 	}
 
@@ -243,7 +228,7 @@ func (l nonInteractiveDeviceCodeLogin) complete(ctx context.Context, userCode, c
 	// valid, so the pending login is kept for a rerun. After a successful
 	// exchange, storeLoginToken deletes it.
 	if errors.Is(err, u2m.ErrInvalidDeviceCode) {
-		if err := pendingLogins.DeletePendingLogin(l.key); err != nil {
+		if err := l.tokenStore.Delete(l.key); err != nil {
 			log.Debugf(ctx, "Failed to delete the pending device code login: %v", err)
 		}
 	}
diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index f69df01612b..b7cf1f046f6 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -498,12 +498,11 @@ func TestLoginDeviceCodeCompletesInTerminal(t *testing.T) {
 	raw, err := os.ReadFile(filepath.Join(os.Getenv("HOME"), ".databricks", "token-cache.json"))
 	require.NoError(t, err)
 	var cache struct {
-		Tokens        map[string]json.RawMessage `json:"tokens"`
-		PendingLogins map[string]json.RawMessage `json:"pending_logins"`
+		Tokens map[string]json.RawMessage `json:"tokens"`
 	}
 	require.NoError(t, json.Unmarshal(raw, &cache))
 	assert.Contains(t, cache.Tokens, server.URL)
-	assert.Empty(t, cache.PendingLogins)
+	assert.NotContains(t, cache.Tokens, pendingLoginKey(server.URL))
 
 	profiles, err := profile.DefaultProfiler.LoadProfiles(t.Context(), profile.MatchAllProfiles)
 	require.NoError(t, err)
diff --git a/cmd/auth/login_test.go b/cmd/auth/login_test.go
index 470136498ad..58fd6455449 100644
--- a/cmd/auth/login_test.go
+++ b/cmd/auth/login_test.go
@@ -76,23 +76,19 @@ func TestStoreLoginTokenDeletesStaleTokenOnFailure(t *testing.T) {
 func TestStoreLoginTokenDeletesPendingDeviceCodeLogin(t *testing.T) {
 	const profileName = "TEST"
 	store := storage.NewMemoryStore()
-	pendingLogins := store.(storage.PendingLoginStore)
-	pending := storage.PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
-	require.NoError(t, pendingLogins.PutPendingLogin(profileName, pending))
-	require.NoError(t, pendingLogins.PutPendingLogin("OTHER", pending))
+	pending := storage.Entry{PendingLogin: &storage.PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}}
+	require.NoError(t, store.Put(pendingLoginKey(profileName), pending))
+	require.NoError(t, store.Put(pendingLoginKey("OTHER"), pending))
 	arg, err := u2m.NewProfileWorkspaceOAuthArgument("https://workspace.example.test", profileName)
 	require.NoError(t, err)
 
 	err = storeLoginToken(t.Context(), store, storage.StorageModeSecure, arg, &oauth2.Token{AccessToken: "new-token"})
 
 	require.NoError(t, err)
-	_, err = pendingLogins.LookupPendingLogin(profileName)
+	_, err = store.Lookup(pendingLoginKey(profileName))
 	assert.ErrorIs(t, err, storage.ErrNotFound)
-	_, err = pendingLogins.LookupPendingLogin("OTHER")
+	_, err = store.Lookup(pendingLoginKey("OTHER"))
 	assert.NoError(t, err)
-	got, err := store.Lookup(profileName)
-	require.NoError(t, err)
-	assert.Equal(t, "new-token", got.Token.AccessToken)
 }
 
 // logBuffer is a thread-safe bytes.Buffer for capturing log output in tests.
diff --git a/cmd/auth/logout.go b/cmd/auth/logout.go
index 9e1438acd5c..7daf17be3e2 100644
--- a/cmd/auth/logout.go
+++ b/cmd/auth/logout.go
@@ -275,7 +275,7 @@ func clearTokenStore(ctx context.Context, p profile.Profile, profiler profile.Pr
 	}
 	// A pending device code login could still complete and restore the
 	// credentials that the user is logging out of.
-	if err := deletePendingLogin(tokenStore, p.Name); err != nil {
+	if err := tokenStore.Delete(pendingLoginKey(p.Name)); err != nil {
 		return fmt.Errorf("failed to delete pending device code login for profile %q: %w", p.Name, err)
 	}
 
@@ -298,7 +298,7 @@ func clearTokenStore(ctx context.Context, p profile.Profile, profiler profile.Pr
 		if err := tokenStore.Delete(hostCacheKey); err != nil {
 			return fmt.Errorf("failed to delete host-keyed token for %q: %w", hostCacheKey, err)
 		}
-		if err := deletePendingLogin(tokenStore, hostCacheKey); err != nil {
+		if err := tokenStore.Delete(pendingLoginKey(hostCacheKey)); err != nil {
 			return fmt.Errorf("failed to delete pending device code login for %q: %w", hostCacheKey, err)
 		}
 	}
diff --git a/libs/auth/storage/filestore.go b/libs/auth/storage/filestore.go
index e58f061b9f1..18586a68ca4 100644
--- a/libs/auth/storage/filestore.go
+++ b/libs/auth/storage/filestore.go
@@ -41,12 +41,6 @@ const (
 	//       "refresh_token": "<refresh_token>",
 	//       "expiry": "<expiry>"
 	//     }
-	//   },
-	//   "pending_logins": {
-	//     "<key>": {
-	//       "device_code": "<device_code>",
-	//       "user_code": "<user_code>"
-	//     }
 	//   }
 	// }
 	tokenStoreVersion = 1
@@ -57,17 +51,13 @@ const (
 // the historical bare-token format, leaving room for additive sibling fields.
 type fileEntry struct {
 	*oauth2.Token
+	PendingLogin *PendingLogin `json:"pending_login,omitempty"`
 }
 
 // tokenStoreFile is the format of the token store file.
 type tokenStoreFile struct {
 	Version int                   `json:"version"`
 	Tokens  map[string]*fileEntry `json:"tokens"`
-
-	// PendingLogins are apart from Tokens, so that their keys cannot clash.
-	// Older CLI versions drop them when they write the file, which only means
-	// that a pending login has to be started again.
-	PendingLogins map[string]PendingLogin `json:"pending_logins,omitempty"`
 }
 
 type FileStoreOption func(*fileStore)
@@ -118,7 +108,7 @@ func (c *fileStore) Put(key string, e Entry) error {
 	if f.Tokens == nil {
 		f.Tokens = map[string]*fileEntry{}
 	}
-	f.Tokens[key] = &fileEntry{Token: e.Token}
+	f.Tokens[key] = &fileEntry{Token: e.Token, PendingLogin: e.PendingLogin}
 	return c.write(f)
 }
 
@@ -134,7 +124,7 @@ func (c *fileStore) Lookup(key string) (Entry, error) {
 	if !ok {
 		return Entry{}, ErrNotFound
 	}
-	return Entry{Token: fe.Token}, nil
+	return Entry{Token: fe.Token, PendingLogin: fe.PendingLogin}, nil
 }
 
 // Delete implements the Store interface. Removing a missing key is a no-op.
@@ -149,53 +139,6 @@ func (c *fileStore) Delete(key string) error {
 	return c.write(f)
 }
 
-// PutPendingLogin implements the PendingLoginStore interface.
-func (c *fileStore) PutPendingLogin(key string, p PendingLogin) error {
-	c.locker.Lock()
-	defer c.locker.Unlock()
-	f, err := c.load()
-	if err != nil {
-		return fmt.Errorf("load: %w", err)
-	}
-	if f.PendingLogins == nil {
-		f.PendingLogins = map[string]PendingLogin{}
-	}
-	f.PendingLogins[key] = p
-	return c.write(f)
-}
-
-// LookupPendingLogin implements the PendingLoginStore interface.
-func (c *fileStore) LookupPendingLogin(key string) (PendingLogin, error) {
-	c.locker.Lock()
-	defer c.locker.Unlock()
-	f, err := c.load()
-	if err != nil {
-		return PendingLogin{}, fmt.Errorf("load: %w", err)
-	}
-	p, ok := f.PendingLogins[key]
-	if !ok {
-		return PendingLogin{}, ErrNotFound
-	}
-	return p, nil
-}
-
-// DeletePendingLogin implements the PendingLoginStore interface. Every login
-// deletes the pending login of its target, so the file is only written when
-// there is one.
-func (c *fileStore) DeletePendingLogin(key string) error {
-	c.locker.Lock()
-	defer c.locker.Unlock()
-	f, err := c.load()
-	if err != nil {
-		return fmt.Errorf("load: %w", err)
-	}
-	if _, ok := f.PendingLogins[key]; !ok {
-		return nil
-	}
-	delete(f.PendingLogins, key)
-	return c.write(f)
-}
-
 // write marshals f and atomically replaces the store file.
 func (c *fileStore) write(f *tokenStoreFile) error {
 	raw, err := json.MarshalIndent(f, "", "  ")
@@ -264,6 +207,3 @@ func (c *fileStore) load() (*tokenStoreFile, error) {
 	}
 	return f, nil
 }
-
-// Compile-time confirmation that fileStore keeps pending logins.
-var _ PendingLoginStore = (*fileStore)(nil)
diff --git a/libs/auth/storage/filestore_test.go b/libs/auth/storage/filestore_test.go
index 37e10908ed3..de5db01612b 100644
--- a/libs/auth/storage/filestore_test.go
+++ b/libs/auth/storage/filestore_test.go
@@ -36,48 +36,31 @@ func TestStoreAndLookup(t *testing.T) {
 	assert.Equal(t, ErrNotFound, err)
 }
 
-func TestPendingLoginIsApartFromTokens(t *testing.T) {
+func TestStoreAndLookupPendingLogin(t *testing.T) {
 	f := setup(t)
 	c, err := NewFileStore(t.Context(), WithFileLocation(f))
 	require.NoError(t, err)
-	pendingLogins := c.(PendingLoginStore)
-	pending := PendingLogin{
+	pending := &PendingLogin{
 		DeviceCode: "device-code",
 		UserCode:   "WDJBMJHT",
 		Host:       "https://workspace.test",
 		Scopes:     []string{"sql"},
 	}
-	require.NoError(t, c.Put("x", Entry{Token: &oauth2.Token{AccessToken: "abc"}}))
-	require.NoError(t, pendingLogins.PutPendingLogin("x", pending))
+	require.NoError(t, c.Put("x#device-code", Entry{PendingLogin: pending}))
 
-	got, err := c.Lookup("x")
-	require.NoError(t, err)
-	assert.Equal(t, "abc", got.Token.AccessToken)
-	gotPending, err := pendingLogins.LookupPendingLogin("x")
+	got, err := c.Lookup("x#device-code")
 	require.NoError(t, err)
-	assert.Equal(t, pending, gotPending)
-	_, err = pendingLogins.LookupPendingLogin("y")
-	assert.ErrorIs(t, err, ErrNotFound)
+	assert.Nil(t, got.Token)
+	assert.Equal(t, pending, got.PendingLogin)
 
 	raw, err := os.ReadFile(f)
 	require.NoError(t, err)
 	assert.JSONEq(t, `{
 		"version": 1,
 		"tokens": {
-			"x": {"access_token": "abc", "expiry": "0001-01-01T00:00:00Z"}
-		},
-		"pending_logins": {
-			"x": {"device_code": "device-code", "user_code": "WDJBMJHT", "host": "https://workspace.test", "scopes": ["sql"]}
+			"x#device-code": {"pending_login": {"device_code": "device-code", "user_code": "WDJBMJHT", "host": "https://workspace.test", "scopes": ["sql"]}}
 		}
 	}`, string(raw))
-
-	require.NoError(t, pendingLogins.DeletePendingLogin("x"))
-	require.NoError(t, pendingLogins.DeletePendingLogin("y"))
-	_, err = pendingLogins.LookupPendingLogin("x")
-	assert.ErrorIs(t, err, ErrNotFound)
-	got, err = c.Lookup("x")
-	require.NoError(t, err)
-	assert.Equal(t, "abc", got.Token.AccessToken)
 }
 
 func TestNoStoreFileReturnsErrNotConfigured(t *testing.T) {
diff --git a/libs/auth/storage/keyring.go b/libs/auth/storage/keyring.go
index 894d9dc9832..1beccdca3e5 100644
--- a/libs/auth/storage/keyring.go
+++ b/libs/auth/storage/keyring.go
@@ -17,10 +17,6 @@ import (
 // cache key the U2M manager passes through Store.Put / Lookup.
 const keyringServiceName = "databricks-cli"
 
-// pendingLoginServiceName is the keyring service under which pending logins
-// are stored. It keeps them apart from the tokens under keyringServiceName.
-const pendingLoginServiceName = "databricks-cli-pending-login"
-
 // keyringProbeAccountPrefix is prefixed onto a per-call random suffix to form
 // the account name ProbeKeyring writes and deletes. A fixed name like
 // "__probe__" could collide with a user profile of the same name (which is
@@ -51,7 +47,8 @@ type keyringBackend interface {
 // checksum, store time, ...) without breaking older CLI versions that read
 // the same entry.
 type keyringEntry struct {
-	Token *oauth2.Token `json:"token"`
+	Token        *oauth2.Token `json:"token"`
+	PendingLogin *PendingLogin `json:"pending_login,omitempty"`
 }
 
 // zalandoBackend delegates to the process-wide zalando/go-keyring provider.
@@ -172,60 +169,9 @@ func (k *keyringStore) Delete(key string) error {
 
 // Lookup implements the Store interface, returning ErrNotFound on a miss.
 func (k *keyringStore) Lookup(key string) (Entry, error) {
-	raw, err := k.get(k.keyringSvcName, key)
-	if err != nil {
-		return Entry{}, err
-	}
-
-	var entry keyringEntry
-	if err := json.Unmarshal([]byte(raw), &entry); err != nil {
-		return Entry{}, fmt.Errorf("unmarshal token: %w", err)
-	}
-	return Entry(entry), nil
-}
-
-// PutPendingLogin implements the PendingLoginStore interface.
-func (k *keyringStore) PutPendingLogin(key string, p PendingLogin) error {
-	raw, err := json.Marshal(p)
-	if err != nil {
-		return fmt.Errorf("marshal pending login: %w", err)
-	}
-	return k.withTimeout("set", func() error {
-		return k.backend.Set(pendingLoginServiceName, key, string(raw))
-	})
-}
-
-// LookupPendingLogin implements the PendingLoginStore interface, returning
-// ErrNotFound on a miss.
-func (k *keyringStore) LookupPendingLogin(key string) (PendingLogin, error) {
-	raw, err := k.get(pendingLoginServiceName, key)
-	if err != nil {
-		return PendingLogin{}, err
-	}
-	var p PendingLogin
-	if err := json.Unmarshal([]byte(raw), &p); err != nil {
-		return PendingLogin{}, fmt.Errorf("unmarshal pending login: %w", err)
-	}
-	return p, nil
-}
-
-// DeletePendingLogin implements the PendingLoginStore interface. Removing a
-// missing pending login is a no-op.
-func (k *keyringStore) DeletePendingLogin(key string) error {
-	return k.withTimeout("delete", func() error {
-		err := k.backend.Delete(pendingLoginServiceName, key)
-		if errors.Is(err, keyring.ErrNotFound) {
-			return nil
-		}
-		return err
-	})
-}
-
-// get returns the secret stored under key in service, or ErrNotFound.
-func (k *keyringStore) get(service, key string) (string, error) {
 	var raw string
 	err := k.withTimeout("get", func() error {
-		got, gerr := k.backend.Get(service, key)
+		got, gerr := k.backend.Get(k.keyringSvcName, key)
 		if gerr != nil {
 			return gerr
 		}
@@ -233,12 +179,17 @@ func (k *keyringStore) get(service, key string) (string, error) {
 		return nil
 	})
 	if errors.Is(err, keyring.ErrNotFound) {
-		return "", ErrNotFound
+		return Entry{}, ErrNotFound
 	}
 	if err != nil {
-		return "", wrapKeyringUnreachable(err)
+		return Entry{}, wrapKeyringUnreachable(err)
 	}
-	return raw, nil
+
+	var entry keyringEntry
+	if err := json.Unmarshal([]byte(raw), &entry); err != nil {
+		return Entry{}, fmt.Errorf("unmarshal token: %w", err)
+	}
+	return Entry(entry), nil
 }
 
 // wrapKeyringUnreachable wraps a non-ErrNotFound keyring error with
@@ -259,11 +210,8 @@ func wrapKeyringUnreachable(err error) error {
 	return fmt.Errorf("OS keyring unreachable: %w (set DATABRICKS_AUTH_STORAGE=plaintext or run `databricks auth login` to use file-based token storage)", err)
 }
 
-// Compile-time confirmation that keyringStore satisfies the CLI interfaces.
-var (
-	_ Store             = (*keyringStore)(nil)
-	_ PendingLoginStore = (*keyringStore)(nil)
-)
+// Compile-time confirmation that keyringStore satisfies the CLI interface.
+var _ Store = (*keyringStore)(nil)
 
 // TimeoutError is returned when a keyring operation exceeds the configured
 // timeout. Callers can use errors.As to detect and present a clear message.
diff --git a/libs/auth/storage/keyring_test.go b/libs/auth/storage/keyring_test.go
index bf38943844e..77a7ced4779 100644
--- a/libs/auth/storage/keyring_test.go
+++ b/libs/auth/storage/keyring_test.go
@@ -118,27 +118,17 @@ func TestKeyringStore_Lookup_ReturnsStoredToken(t *testing.T) {
 	assert.Equal(t, "Bearer", got.Token.TokenType)
 }
 
-func TestKeyringStore_PendingLoginIsApartFromTokens(t *testing.T) {
+func TestKeyringStore_Lookup_ReturnsStoredPendingLogin(t *testing.T) {
 	backend := newFakeBackend()
 	c := newTestStore(backend)
-	pending := PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
-	require.NoError(t, c.Put("my-profile", Entry{Token: &oauth2.Token{AccessToken: "abc"}}))
-	require.NoError(t, c.PutPendingLogin("my-profile", pending))
 
-	got, err := c.Lookup("my-profile")
-	require.NoError(t, err)
-	assert.Equal(t, "abc", got.Token.AccessToken)
-	gotPending, err := c.LookupPendingLogin("my-profile")
-	require.NoError(t, err)
-	assert.Equal(t, pending, gotPending)
-	assert.Contains(t, backend.items, itemKey(pendingLoginServiceName, "my-profile"))
+	want := &PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
+	require.NoError(t, c.Put("my-profile#device-code", Entry{PendingLogin: want}))
 
-	require.NoError(t, c.DeletePendingLogin("my-profile"))
-	require.NoError(t, c.DeletePendingLogin("my-profile"))
-	_, err = c.LookupPendingLogin("my-profile")
-	assert.ErrorIs(t, err, ErrNotFound)
-	_, err = c.Lookup("my-profile")
-	assert.NoError(t, err)
+	got, err := c.Lookup("my-profile#device-code")
+	require.NoError(t, err)
+	assert.Nil(t, got.Token)
+	assert.Equal(t, want, got.PendingLogin)
 }
 
 func TestKeyringStore_Lookup_MissingReturnsCacheErrNotFound(t *testing.T) {
diff --git a/libs/auth/storage/memory.go b/libs/auth/storage/memory.go
index 777fdac27df..d639cf5f108 100644
--- a/libs/auth/storage/memory.go
+++ b/libs/auth/storage/memory.go
@@ -11,13 +11,12 @@ import (
 // default store used by PersistentAuth when no WithTokenStore option is
 // provided. Most production consumers should supply a persistent Store.
 func NewMemoryStore() Store {
-	return &memoryStore{entries: map[string]Entry{}, pendingLogins: map[string]PendingLogin{}}
+	return &memoryStore{entries: map[string]Entry{}}
 }
 
 type memoryStore struct {
-	mu            sync.Mutex
-	entries       map[string]Entry
-	pendingLogins map[string]PendingLogin
+	mu      sync.Mutex
+	entries map[string]Entry
 }
 
 func cloneToken(t *oauth2.Token) *oauth2.Token {
@@ -30,6 +29,10 @@ func cloneToken(t *oauth2.Token) *oauth2.Token {
 
 func cloneEntry(e Entry) Entry {
 	e.Token = cloneToken(e.Token)
+	if e.PendingLogin != nil {
+		pending := *e.PendingLogin
+		e.PendingLogin = &pending
+	}
 	return e
 }
 
@@ -59,34 +62,3 @@ func (s *memoryStore) Delete(key string) error {
 	delete(s.entries, key)
 	return nil
 }
-
-// PutPendingLogin implements PendingLoginStore.
-func (s *memoryStore) PutPendingLogin(key string, p PendingLogin) error {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.pendingLogins[key] = p
-	return nil
-}
-
-// LookupPendingLogin implements PendingLoginStore. Returns ErrNotFound when
-// the key is absent.
-func (s *memoryStore) LookupPendingLogin(key string) (PendingLogin, error) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	p, ok := s.pendingLogins[key]
-	if !ok {
-		return PendingLogin{}, ErrNotFound
-	}
-	return p, nil
-}
-
-// DeletePendingLogin implements PendingLoginStore.
-func (s *memoryStore) DeletePendingLogin(key string) error {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	delete(s.pendingLogins, key)
-	return nil
-}
-
-// Compile-time confirmation that memoryStore keeps pending logins.
-var _ PendingLoginStore = (*memoryStore)(nil)
diff --git a/libs/auth/storage/memory_test.go b/libs/auth/storage/memory_test.go
index e3ff27bcd1c..2a28d9b197a 100644
--- a/libs/auth/storage/memory_test.go
+++ b/libs/auth/storage/memory_test.go
@@ -57,25 +57,16 @@ func TestMemoryStore_PutAndLookupUseCopies(t *testing.T) {
 	}
 }
 
-func TestMemoryStore_PendingLoginIsApartFromTokens(t *testing.T) {
+func TestMemoryStore_PendingLoginUsesCopies(t *testing.T) {
 	s := NewMemoryStore()
-	pendingLogins := s.(PendingLoginStore)
-	pending := PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
-	require.NoError(t, s.Put("key1", Entry{Token: &oauth2.Token{AccessToken: "abc"}}))
-	require.NoError(t, pendingLogins.PutPendingLogin("key1", pending))
+	pending := &PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
+	require.NoError(t, s.Put("key1", Entry{PendingLogin: pending}))
+
+	pending.DeviceCode = "mutated-after-store"
 
 	got, err := s.Lookup("key1")
 	require.NoError(t, err)
-	assert.Equal(t, "abc", got.Token.AccessToken)
-	gotPending, err := pendingLogins.LookupPendingLogin("key1")
-	require.NoError(t, err)
-	assert.Equal(t, pending, gotPending)
-
-	require.NoError(t, pendingLogins.DeletePendingLogin("key1"))
-	_, err = pendingLogins.LookupPendingLogin("key1")
-	assert.ErrorIs(t, err, ErrNotFound)
-	_, err = s.Lookup("key1")
-	assert.NoError(t, err)
+	assert.Equal(t, "device-code", got.PendingLogin.DeviceCode)
 }
 
 func TestMemoryStore_Delete(t *testing.T) {
diff --git a/libs/auth/storage/storage.go b/libs/auth/storage/storage.go
index 43eaaaf15c5..8f15f465e4e 100644
--- a/libs/auth/storage/storage.go
+++ b/libs/auth/storage/storage.go
@@ -24,13 +24,18 @@ var ErrNotFound = errors.New("token not found")
 // without changing the Store interface. Backends persist it verbatim and never
 // interpret its contents.
 type Entry struct {
-	// Token is the cached OAuth token. Always set for stored entries.
+	// Token is the cached OAuth token. Set for every stored entry except a
+	// pending login.
 	Token *oauth2.Token
+
+	// PendingLogin is set instead of Token for a login that one CLI
+	// invocation started and a later one completes.
+	PendingLogin *PendingLogin
 }
 
-// PendingLogin is a device code login that one CLI invocation started and a
-// later one completes once the user has the confirmation code. Keeping the
-// device code in the store means it is never printed.
+// PendingLogin is a device code login that is waiting for the user's
+// confirmation code. Keeping the device code in the store means it never
+// leaves the machine that started the login.
 type PendingLogin struct {
 	// DeviceCode is exchanged together with the confirmation code for a token.
 	DeviceCode string `json:"device_code"`
@@ -48,24 +53,6 @@ type PendingLogin struct {
 	Scopes   []string `json:"scopes,omitempty"`
 }
 
-// PendingLoginStore holds pending logins. The file, keyring and memory stores
-// implement it next to Store and keep pending logins apart from the tokens,
-// so that a pending login can neither replace a token nor be read as one,
-// whatever a profile is named.
-type PendingLoginStore interface {
-	// PutPendingLogin writes p under key, replacing any existing pending
-	// login.
-	PutPendingLogin(key string, p PendingLogin) error
-
-	// LookupPendingLogin returns the pending login stored under key, or
-	// ErrNotFound.
-	LookupPendingLogin(key string) (PendingLogin, error)
-
-	// DeletePendingLogin removes the pending login under key. Deleting a
-	// missing pending login is not an error.
-	DeletePendingLogin(key string) error
-}
-
 // Store is the CLI's token-storage abstraction: a key/value store with no
 // policy of its own. Implementations are the plaintext file cache and the OS
 // keyring and in-memory stores. The entry schema can evolve with additive

From 05dd7de73b28d349c1b57039fc71a908476c2c41 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Thu, 29 Oct 2026 16:13:44 +0000
Subject: [PATCH 13/29] Revert "Skip the workspace picker in the
 non-interactive device code login"

This reverts commit bda3307be. The picker only prompted when the second
step ran in a terminal for a host whose metadata has an account ID but no
workspace ID, and the prompt can be skipped, so the extra branch is not
worth it.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/login.go                  | 13 ++---------
 cmd/auth/login_device_code_test.go | 37 ------------------------------
 2 files changed, 2 insertions(+), 48 deletions(-)

diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index a02d427b764..18d92f8307e 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -79,9 +79,6 @@ const (
 	// deviceCodeEnvVar enables the experimental device code login flow
 	// (--use-device-code) while it is experimental.
 	deviceCodeEnvVar = "DATABRICKS_CLI_DEVICE_CODE"
-	// workspaceIDHint is shown instead of the workspace picker when login
-	// cannot prompt.
-	workspaceIDHint = "To use workspace commands, set workspace_id in your profile or pass --workspace-id."
 )
 
 // discoveryErr wraps an error (or creates a new one) and appends the
@@ -504,13 +501,7 @@ a new profile is created.
 		// 2. Configuring cluster and serverless;
 		// 3. Saving the profile.
 
-		promptWorkspace := shouldPromptWorkspace(authArguments, existingProfile, skipWorkspace)
-		switch {
-		case promptWorkspace && nonInteractive:
-			// The non-interactive device code login does not prompt, even in
-			// a terminal.
-			cmdio.LogString(ctx, workspaceIDHint)
-		case promptWorkspace:
+		if shouldPromptWorkspace(authArguments, existingProfile, skipWorkspace) {
 			wsID, wsErr := promptForWorkspaceSelection(ctx, authArguments, tokenSource)
 			if wsErr != nil {
 				log.Warnf(ctx, "Workspace selection failed: %v", wsErr)
@@ -1025,7 +1016,7 @@ func u2mResourcesFromProfile(p *profile.Profile) []string {
 // to the user.
 func promptForWorkspaceSelection(ctx context.Context, authArguments *auth.AuthArguments, tokenSource oauth2.TokenSource) (string, error) {
 	if !cmdio.IsPromptSupported(ctx) {
-		cmdio.LogString(ctx, workspaceIDHint)
+		cmdio.LogString(ctx, "To use workspace commands, set workspace_id in your profile or pass --workspace-id.")
 		return "", nil
 	}
 
diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index b7cf1f046f6..c0987025a41 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -5,11 +5,8 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"io"
 	"net/http"
-	"net/http/httptest"
-	"net/http/httputil"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -512,40 +509,6 @@ func TestLoginDeviceCodeCompletesInTerminal(t *testing.T) {
 // A user code that does not match the pending login fails before the token
 // exchange, so the confirmation code is not sent with the device code of
 // another login.
-func TestLoginDeviceCodeCompletionInTerminalSkipsWorkspacePicker(t *testing.T) {
-	backend := newDeviceCodeServer(t)
-	backendURL, err := url.Parse(backend.URL)
-	require.NoError(t, err)
-	// The host metadata of the fake server has a workspace ID, which skips the
-	// workspace picker. Without it, login with an account ID asks for the
-	// workspace.
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/.well-known/databricks-config" {
-			fmt.Fprintf(w, `{"oidc_endpoint": %q}`, backend.URL+"/oidc")
-			return
-		}
-		httputil.NewSingleHostReverseProxy(backendURL).ServeHTTP(w, r)
-	}))
-	t.Cleanup(server.Close)
-	setUpDeviceCodeLogin(t, "")
-	host := server.URL + "?a=123"
-	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), flags.OutputText, strings.NewReader(""), &bytes.Buffer{}, &bytes.Buffer{}, "", ""))
-	require.NoError(t, runDeviceCodeLogin(ctx, "--host", host, "--profile", "test"))
-
-	tm := termtest.Run(t, func(ctx context.Context) (struct{}, error) {
-		return struct{}{}, runDeviceCodeLogin(ctx, "--host", host, "--profile", "test", "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY")
-	})
-	tm.WaitFor(workspaceIDHint)
-	_, err = tm.Result()
-	require.NoError(t, err)
-
-	profiles, err := profile.DefaultProfiler.LoadProfiles(t.Context(), profile.WithName("test"))
-	require.NoError(t, err)
-	require.Len(t, profiles, 1)
-	assert.Equal(t, "123", profiles[0].AccountID)
-	assert.Empty(t, profiles[0].WorkspaceID)
-}
-
 func TestLoginDeviceCodeCompletionChecksUserCode(t *testing.T) {
 	server := newDeviceCodeServer(t)
 	var tokenRequests atomic.Int32

From 959b693418f3e702bc557c78c0d729578e865573 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Fri, 30 Oct 2026 17:14:47 +0000
Subject: [PATCH 14/29] Treat a token store entry without a token as a missing
 token

A pending device code login is stored under the cache key with a
#device-code suffix, which a profile can also be named. Looking up the
token of such a profile found the pending login, and auth token failed
with a nil pointer dereference when it read the refresh token. The entry
is now reported as storage.ErrNotFound.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 libs/auth/u2m/persistent_auth.go      |  6 +++++-
 libs/auth/u2m/persistent_auth_test.go | 26 ++++++++++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/libs/auth/u2m/persistent_auth.go b/libs/auth/u2m/persistent_auth.go
index 1e3709ef04d..c7939da3da6 100644
--- a/libs/auth/u2m/persistent_auth.go
+++ b/libs/auth/u2m/persistent_auth.go
@@ -304,6 +304,10 @@ func (a *PersistentAuth) loadToken() (*oauth2.Token, error) {
 	if err != nil {
 		return nil, fmt.Errorf("cache: %w", err)
 	}
+	// An entry that holds a pending login has no token yet.
+	if e.Token == nil {
+		return nil, fmt.Errorf("cache: %w", storage.ErrNotFound)
+	}
 	return e.Token, nil
 }
 
@@ -389,7 +393,7 @@ func (a *PersistentAuth) recoverStoreUpdate(old, candidate *oauth2.Token) *oauth
 		}
 
 		cached, err := a.store.Lookup(a.oAuthArgument.GetCacheKey())
-		if err == nil && isFreshReplacement(old, candidate, cached.Token) {
+		if err == nil && cached.Token != nil && isFreshReplacement(old, candidate, cached.Token) {
 			return cached.Token
 		}
 	}
diff --git a/libs/auth/u2m/persistent_auth_test.go b/libs/auth/u2m/persistent_auth_test.go
index 74eefc3fad0..8778daeab20 100644
--- a/libs/auth/u2m/persistent_auth_test.go
+++ b/libs/auth/u2m/persistent_auth_test.go
@@ -69,6 +69,32 @@ func TestToken(t *testing.T) {
 	}
 }
 
+func TestToken_EntryWithoutToken(t *testing.T) {
+	cache := &tokenStoreMock{
+		lookup: func(key string) (*oauth2.Token, error) {
+			return nil, nil
+		},
+	}
+	arg, err := NewBasicAccountOAuthArgument("https://abc", "xyz")
+	if err != nil {
+		t.Fatalf("NewBasicAccountOAuthArgument(): want no error, got %v", err)
+	}
+	p, err := NewPersistentAuth(t.Context(), WithTokenStore(cache), WithOAuthArgument(arg))
+	if err != nil {
+		t.Fatalf("NewPersistentAuth(): want no error, got %v", err)
+	}
+	defer p.Close()
+
+	for name, get := range map[string]func() (*oauth2.Token, error){
+		"Token":             p.Token,
+		"ForceRefreshToken": p.ForceRefreshToken,
+	} {
+		if _, err := get(); !errors.Is(err, storage.ErrNotFound) {
+			t.Errorf("p.%s(): want storage.ErrNotFound, got %v", name, err)
+		}
+	}
+}
+
 func TestToken_WithProfile(t *testing.T) {
 	profileKey := "my-profile"
 	cache := &tokenStoreMock{

From 41a45d3ca7528c5f6ac409edcea7b57f53a9a66c Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Fri, 30 Oct 2026 17:16:39 +0000
Subject: [PATCH 15/29] Reject profile names that end with #device-code in auth
 login

The pending device code login of profile a is stored under the token store
key a#device-code, which is also the key of the token of profile
a#device-code. A login for a then replaced that token, and every login and
logout of a deleted it. auth login now rejects such profile names, both at
the profile name prompt and when they are passed with --profile.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 .../login/device-code/non-interactive/errors/output.txt  | 5 +++++
 .../auth/login/device-code/non-interactive/errors/script | 3 +++
 cmd/auth/login.go                                        | 6 ++++++
 cmd/auth/login_device_code.go                            | 9 +++++++++
 cmd/auth/login_test.go                                   | 4 +++-
 5 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
index e293a7f47c2..19505cddaa8 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
@@ -31,6 +31,11 @@ Error: --user-code requires --confirmation-code
 >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
 Error: --confirmation-code requires --use-device-code
 
+=== Profile name that marks a pending login
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test#device-code --use-device-code
+Error: profile name "test#device-code" must not end with #device-code, which marks pending device code logins
+
 === Account host
 
 >>> musterr [CLI] auth login --host https://accounts.cloud.databricks.test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/errors/script b/acceptance/cmd/auth/login/device-code/non-interactive/errors/script
index 69517fddaf2..76e79bddad8 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/errors/script
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/errors/script
@@ -20,6 +20,9 @@ trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-devic
 trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT
 trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
 
+title "Profile name that marks a pending login\n"
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile 'test#device-code' --use-device-code
+
 title "Account host\n"
 trace musterr $CLI auth login --host https://accounts.cloud.databricks.test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
 
diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index 18d92f8307e..044194cf652 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -54,6 +54,9 @@ func promptForProfile(ctx context.Context, defaultValue string, takenNames []str
 			if err := databrickscfg.ValidateProfileName(input); err != nil {
 				return err
 			}
+			if err := validateLoginProfileName(input); err != nil {
+				return err
+			}
 			if slices.Contains(takenNames, input) {
 				return fmt.Errorf("profile %s already exists. Choose a different name, or rerun with --profile %s to use it", input, input)
 			}
@@ -364,6 +367,9 @@ a new profile is created.
 				return err
 			}
 		}
+		if err := validateLoginProfileName(profileName); err != nil {
+			return err
+		}
 
 		// Load parameters from the existing profile if any.
 		existingProfile, err := loadProfileByName(ctx, profileName, profile.DefaultProfiler)
diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index a2228c5d15d..10297fa814e 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -153,6 +153,15 @@ func pendingLoginKey(cacheKey string) string {
 	return cacheKey + pendingLoginKeySuffix
 }
 
+// validateLoginProfileName returns an error if the token of profile name would
+// share its token store key with the pending login of another profile.
+func validateLoginProfileName(name string) error {
+	if strings.HasSuffix(name, pendingLoginKeySuffix) {
+		return fmt.Errorf("profile name %q must not end with %s, which marks pending device code logins", name, pendingLoginKeySuffix)
+	}
+	return nil
+}
+
 // target describes the login in errors.
 func (l nonInteractiveDeviceCodeLogin) target() string {
 	if l.profile != "" {
diff --git a/cmd/auth/login_test.go b/cmd/auth/login_test.go
index 58fd6455449..711ff907f0d 100644
--- a/cmd/auth/login_test.go
+++ b/cmd/auth/login_test.go
@@ -1493,7 +1493,9 @@ func TestPromptForProfileRejectsTakenName(t *testing.T) {
 	tm.WaitFor(">> profile taken already exists. Choose a different name, or rerun with --profile taken to use it")
 	tm.Type(strings.Repeat(termtest.KeyBackspace, len("taken")) + "__settings__" + termtest.KeyEnter)
 	tm.WaitFor(`>> profile name "__settings__" is reserved for internal use`)
-	tm.Type(strings.Repeat(termtest.KeyBackspace, len("__settings__")) + "take" + termtest.KeyEnter)
+	tm.Type(strings.Repeat(termtest.KeyBackspace, len("__settings__")) + "take#device-code" + termtest.KeyEnter)
+	tm.WaitFor(`>> profile name "take#device-code" must not end with #device-code, which marks pending device code logins`)
+	tm.Type(strings.Repeat(termtest.KeyBackspace, len("#device-code")) + termtest.KeyEnter)
 	name, err := tm.Result()
 	require.NoError(t, err)
 	assert.Equal(t, "take", name)

From 1508d4aca41dafd8a333747c83794fff735a5942 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Fri, 30 Oct 2026 17:19:16 +0000
Subject: [PATCH 16/29] Start a new device code login after the token requests
 are rate limited

The server answers further token requests for a device code with HTTP 429
after too many confirmation codes were sent for it. The second step of the
non-interactive login kept the pending login and returned the error
without a hint, so rerunning the command got the same error. The token
exchange error now matches ErrDeviceCodeRateLimited, and the second step
deletes the pending login and tells how to start a new one, as it does for
an invalid device code.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/login_device_code.go      | 13 +++++++------
 cmd/auth/login_device_code_test.go | 25 +++++++++++++++++++++++++
 docs/device-code-login.md          |  1 +
 libs/auth/u2m/device_code.go       | 14 +++++++++++---
 libs/auth/u2m/device_code_test.go  |  3 +++
 5 files changed, 47 insertions(+), 9 deletions(-)

diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index 10297fa814e..32efd351797 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -232,11 +232,12 @@ func (l nonInteractiveDeviceCodeLogin) complete(ctx context.Context, userCode, c
 	if err != nil {
 		err = fmt.Errorf("token exchange: %w", err)
 	}
-	// The server no longer accepts an invalid device code, so its pending
-	// login is deleted. A wrong confirmation code leaves the device code
-	// valid, so the pending login is kept for a rerun. After a successful
-	// exchange, storeLoginToken deletes it.
-	if errors.Is(err, u2m.ErrInvalidDeviceCode) {
+	// The server no longer accepts an invalid or rate limited device code,
+	// so its pending login is deleted. A wrong confirmation code leaves the
+	// device code valid, so the pending login is kept for a rerun. After a
+	// successful exchange, storeLoginToken deletes it.
+	deviceCodeUnusable := errors.Is(err, u2m.ErrInvalidDeviceCode) || errors.Is(err, u2m.ErrDeviceCodeRateLimited)
+	if deviceCodeUnusable {
 		if err := l.tokenStore.Delete(l.key); err != nil {
 			log.Debugf(ctx, "Failed to delete the pending device code login: %v", err)
 		}
@@ -244,7 +245,7 @@ func (l nonInteractiveDeviceCodeLogin) complete(ctx context.Context, userCode, c
 	switch {
 	case errors.Is(err, u2m.ErrInvalidConfirmationCode):
 		return nil, fmt.Errorf("%w. Check the confirmation code and approve the login if you haven't, then rerun this command. %s if it still fails", err, startNewLoginHint)
-	case errors.Is(err, u2m.ErrInvalidDeviceCode):
+	case deviceCodeUnusable:
 		return nil, fmt.Errorf("%w. %s", err, startNewLoginHint)
 	}
 	return token, err
diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index c0987025a41..189eb9fb74c 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -589,6 +589,31 @@ func TestLoginDeviceCodeCompletionChecksSettings(t *testing.T) {
 	}
 }
 
+// The server keeps rejecting the token requests for a rate limited device
+// code, so its pending login is deleted.
+func TestLoginDeviceCodeCompletionRateLimited(t *testing.T) {
+	server := testserver.New(t)
+	// The router keeps the first handler registered for a route, so this one
+	// replaces the default token endpoint.
+	server.Handle("POST", "/oidc/v1/token", func(_ testserver.Request) any {
+		return testserver.Response{
+			StatusCode: http.StatusTooManyRequests,
+			Body:       map[string]string{"error": "invalid_request", "error_description": "Device grant rate limit exceeded"},
+		}
+	})
+	testserver.AddDefaultHandlers(server)
+	setUpDeviceCodeLogin(t, "")
+	ctx := cmdio.MockDiscard(t.Context())
+	require.NoError(t, runDeviceCodeLogin(ctx, "--host", server.URL, "--profile", "test"))
+
+	args := []string{"--host", server.URL, "--profile", "test", "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY"}
+	err := runDeviceCodeLogin(ctx, args...)
+	assert.EqualError(t, err, "token exchange: Device grant rate limit exceeded (error code: invalid_request). "+startNewLoginHint)
+
+	err = runDeviceCodeLogin(ctx, args...)
+	assert.EqualError(t, err, "no pending device code login for profile test. "+startNewLoginHint)
+}
+
 func TestLoginDeviceCodeCompletionWithoutHostSkipsPicker(t *testing.T) {
 	tm := startDeviceCodeLogin(t, "", "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY")
 	_, err := tm.Result()
diff --git a/docs/device-code-login.md b/docs/device-code-login.md
index 27e16ff37eb..5d0d2afc7f4 100644
--- a/docs/device-code-login.md
+++ b/docs/device-code-login.md
@@ -122,6 +122,7 @@ fail with a token refresh error and you need to run the login again.
 | `--configure-cluster is not supported by the non-interactive device code login` | The cluster picker needs a terminal. | Log in first, then set `cluster_id` on the profile. |
 | `token exchange: Invalid confirmation code (error code: invalid_request). Check the confirmation code ...` | The confirmation code was mistyped, or the login was not approved yet. | Check the code and approve the login, then run the command again. If it still fails, start a new login. |
 | `token exchange: Invalid device code (error code: invalid_request). Run the same command without --user-code and --confirmation-code ...` | The login expired. | Start a new login. |
+| `token exchange: Device grant rate limit exceeded (error code: invalid_request). Run the same command without --user-code and --confirmation-code ...` | Too many confirmation codes were sent for this login. | Start a new login. |
 | `a newer login for profile ... replaced this one` | A second login was started for the same profile or host. | Approve the newest code, and complete the newest login with its user code. |
 | `the login for profile ... was started with a different host` (or client ID, or scopes) | The second command does not use the host, `--client-id` or `--scopes` of the first one. | Complete the login with the same command that started it, plus `--user-code` and `--confirmation-code`. |
 | `no pending device code login for profile ...` | The login was already completed, or no login was started for this profile or host. | Start a new login. |
diff --git a/libs/auth/u2m/device_code.go b/libs/auth/u2m/device_code.go
index b062490b69e..e929c5c21f9 100644
--- a/libs/auth/u2m/device_code.go
+++ b/libs/auth/u2m/device_code.go
@@ -42,6 +42,11 @@ var ErrInvalidConfirmationCode = errors.New("invalid confirmation code")
 // login has to be started again.
 var ErrInvalidDeviceCode = errors.New("invalid device code")
 
+// ErrDeviceCodeRateLimited matches the token exchange error for a device code
+// the server received too many token requests for. The login has to be
+// started again.
+var ErrDeviceCodeRateLimited = errors.New("device code rate limited")
+
 // DeviceAuthorization holds what the user needs to approve a device code
 // login from another device, and the device code to exchange afterwards.
 type DeviceAuthorization struct {
@@ -113,9 +118,10 @@ func (l *DeviceCodeLogin) RequestDeviceAuthorization(ctx context.Context) (*Devi
 // RequestDeviceAccessToken completes the login with a single token request.
 // The confirmation code is accepted the way the browser displays it. An error
 // matches ErrInvalidConfirmationCode or ErrInvalidDeviceCode when the server
-// rejects one of the codes. A rejected confirmation code leaves the device
-// code valid, so the exchange can be retried with the right code. The caller
-// is responsible for storing the returned token.
+// rejects one of the codes, and ErrDeviceCodeRateLimited when it rate limits
+// the token requests for the device code. A rejected confirmation code leaves
+// the device code valid, so the exchange can be retried with the right code.
+// The caller is responsible for storing the returned token.
 func (l *DeviceCodeLogin) RequestDeviceAccessToken(ctx context.Context, deviceCode, confirmationCode string) (*oauth2.Token, error) {
 	t, err := l.auth.exchangeDeviceCode(ctx, l.cfg, deviceCode, NormalizeCode(confirmationCode))
 	if err == nil {
@@ -131,6 +137,8 @@ func (l *DeviceCodeLogin) RequestDeviceAccessToken(ctx context.Context, deviceCo
 	status, errCode, description := oauthErrorResponse(err)
 	err = oauthError(err)
 	switch {
+	case status == http.StatusTooManyRequests:
+		return nil, &codeRejectedError{err: err, sentinel: ErrDeviceCodeRateLimited}
 	case status != http.StatusBadRequest || errCode != "invalid_request":
 		return nil, err
 	case description == invalidDeviceCodeDescription:
diff --git a/libs/auth/u2m/device_code_test.go b/libs/auth/u2m/device_code_test.go
index b5d98a00d06..39c369385ce 100644
--- a/libs/auth/u2m/device_code_test.go
+++ b/libs/auth/u2m/device_code_test.go
@@ -176,6 +176,7 @@ func TestDeviceCodeLogin_Errors(t *testing.T) {
 		wantErr               string
 		wantTokenRequests     int32
 		wantInvalidDeviceCode bool
+		wantRateLimited       bool
 	}{
 		{
 			name: "device authorization rejected",
@@ -202,6 +203,7 @@ func TestDeviceCodeLogin_Errors(t *testing.T) {
 			},
 			wantErr:           "Device grant rate limit exceeded (error code: invalid_request)",
 			wantTokenRequests: 1,
+			wantRateLimited:   true,
 		},
 		{
 			name: "unknown device code",
@@ -224,6 +226,7 @@ func TestDeviceCodeLogin_Errors(t *testing.T) {
 			// code again.
 			assert.NotErrorIs(t, err, ErrInvalidConfirmationCode)
 			assert.Equal(t, tc.wantInvalidDeviceCode, errors.Is(err, ErrInvalidDeviceCode))
+			assert.Equal(t, tc.wantRateLimited, errors.Is(err, ErrDeviceCodeRateLimited))
 		})
 	}
 }

From c7b213506c223fb80ed9a9afc799654c164a1f35 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Fri, 30 Oct 2026 17:22:09 +0000
Subject: [PATCH 17/29] Compare the canonical host when completing a device
 code login

The second step of the non-interactive login found the pending login with
the cache key, which uses the canonical host, but compared the host it was
started with as passed. Starting the login with adb-1.azuredatabricks.net
and completing it with https://adb-1.azuredatabricks.net failed with "was
started with a different host". The login now keeps the canonical host.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/login.go                  |  2 +-
 cmd/auth/login_device_code.go      |  4 +++-
 cmd/auth/login_device_code_test.go | 12 ++++++++++++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index 044194cf652..d6ff5a7137f 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -481,7 +481,7 @@ a new profile is created.
 			tokenStore:     tokenStore,
 			key:            pendingLoginKey(oauthArgument.GetCacheKey()),
 			profile:        profileName,
-			host:           authArguments.Host,
+			host:           (&config.Config{Host: authArguments.Host}).CanonicalHostName(),
 			clientID:       clientID,
 			scopes:         scopesList,
 		}
diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index 32efd351797..dbfa92b8c8b 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -136,7 +136,9 @@ func validateDeviceCodeCompletionFlags(cmd *cobra.Command, useDeviceCode bool) e
 // nonInteractiveDeviceCodeLogin runs the two steps of a device code login
 // that cannot read the confirmation code from stdin. The first step stores the
 // device code as a pending login under key, and the second step exchanges it,
-// so that the device code never leaves the machine.
+// so that the device code never leaves the machine. The host is canonical, like
+// the host in the cache key, so that the same host passed in another form
+// completes the login.
 type nonInteractiveDeviceCodeLogin struct {
 	persistentAuth *u2m.PersistentAuth
 	tokenStore     storage.Store
diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index 189eb9fb74c..ba2c2b74c03 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -589,6 +589,18 @@ func TestLoginDeviceCodeCompletionChecksSettings(t *testing.T) {
 	}
 }
 
+// The host of the second step is compared in its canonical form, like the
+// host in the cache key.
+func TestLoginDeviceCodeCompletionWithSameHostInAnotherForm(t *testing.T) {
+	server := newDeviceCodeServer(t)
+	setUpDeviceCodeLogin(t, "")
+	ctx := cmdio.MockDiscard(t.Context())
+	require.NoError(t, runDeviceCodeLogin(ctx, "--host", server.URL))
+
+	err := runDeviceCodeLogin(ctx, "--host", server.URL+"/browse", "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY")
+	assert.NoError(t, err)
+}
+
 // The server keeps rejecting the token requests for a rate limited device
 // code, so its pending login is deleted.
 func TestLoginDeviceCodeCompletionRateLimited(t *testing.T) {

From 64d5accba492247f926178420731f4de66a9aa88 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Fri, 30 Oct 2026 17:23:14 +0000
Subject: [PATCH 18/29] Tell that --user-code does not match instead of blaming
 a newer login

The second step of the non-interactive login said that a newer login
replaced the pending one whenever --user-code did not match it, also when
the user code was mistyped or swapped with the confirmation code. The error
now says that the user code does not match, and mentions a newer login as
one possible cause.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 .../device-code/non-interactive/concurrent/output.txt |  2 +-
 cmd/auth/login_device_code.go                         | 11 ++++++-----
 cmd/auth/login_device_code_test.go                    |  2 +-
 docs/device-code-login.md                             |  2 +-
 4 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt
index 641900bd214..498231147f1 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt
@@ -13,7 +13,7 @@
 ]
 
 >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
-Error: a newer login for profile test replaced this one. Complete the newer login with its user code. Run the same command without --user-code and --confirmation-code to start a new login
+Error: --user-code does not match the pending login for profile test. Check the user code. If you started a newer login, complete it with its user code. Run the same command without --user-code and --confirmation-code to start a new login
 
 >>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code NEWR-CODE --confirmation-code FTFA-QQKY
 Profile test was successfully saved
diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index dbfa92b8c8b..2e16595e71b 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -215,12 +215,13 @@ func (l nonInteractiveDeviceCodeLogin) complete(ctx context.Context, userCode, c
 	if pending == nil {
 		return nil, fmt.Errorf("no pending device code login for %s. %s", l.target(), startNewLoginHint)
 	}
-	// Each profile or host has one pending login, so a newer login replaces
-	// it. Checking the user code here avoids sending the confirmation code
-	// with the wrong device code, which the server would reject as a wrong
-	// confirmation code.
+	// The user code can be mistyped, or belong to a login that a newer one
+	// replaced, because each profile or host has one pending login. Checking
+	// the user code here avoids sending the confirmation code with the wrong
+	// device code, which the server would reject as a wrong confirmation
+	// code.
 	if !sameCode(pending.UserCode, userCode) {
-		return nil, fmt.Errorf("a newer login for %s replaced this one. Complete the newer login with its user code. %s", l.target(), startNewLoginHint)
+		return nil, fmt.Errorf("--user-code does not match the pending login for %s. Check the user code. If you started a newer login, complete it with its user code. %s", l.target(), startNewLoginHint)
 	}
 	if changed := l.changedSetting(*pending); changed != "" {
 		return nil, fmt.Errorf("the login for %s was started with %s. Complete it with the same command that started it. %s", l.target(), changed, startNewLoginHint)
diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index ba2c2b74c03..9608774fc6f 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -522,7 +522,7 @@ func TestLoginDeviceCodeCompletionChecksUserCode(t *testing.T) {
 	require.NoError(t, runDeviceCodeLogin(ctx, "--host", server.URL, "--profile", "test"))
 
 	err := runDeviceCodeLogin(ctx, "--host", server.URL, "--profile", "test", "--user-code", "AAAA-AAAA", "--confirmation-code", "FTFA-QQKY")
-	assert.EqualError(t, err, "a newer login for profile test replaced this one. Complete the newer login with its user code. "+startNewLoginHint)
+	assert.EqualError(t, err, "--user-code does not match the pending login for profile test. Check the user code. If you started a newer login, complete it with its user code. "+startNewLoginHint)
 	assert.Zero(t, tokenRequests.Load())
 
 	// The pending login is kept, and the user code is compared the way the
diff --git a/docs/device-code-login.md b/docs/device-code-login.md
index 5d0d2afc7f4..ea2949b050a 100644
--- a/docs/device-code-login.md
+++ b/docs/device-code-login.md
@@ -123,7 +123,7 @@ fail with a token refresh error and you need to run the login again.
 | `token exchange: Invalid confirmation code (error code: invalid_request). Check the confirmation code ...` | The confirmation code was mistyped, or the login was not approved yet. | Check the code and approve the login, then run the command again. If it still fails, start a new login. |
 | `token exchange: Invalid device code (error code: invalid_request). Run the same command without --user-code and --confirmation-code ...` | The login expired. | Start a new login. |
 | `token exchange: Device grant rate limit exceeded (error code: invalid_request). Run the same command without --user-code and --confirmation-code ...` | Too many confirmation codes were sent for this login. | Start a new login. |
-| `a newer login for profile ... replaced this one` | A second login was started for the same profile or host. | Approve the newest code, and complete the newest login with its user code. |
+| `--user-code does not match the pending login for profile ...` | The user code was mistyped or swapped with the confirmation code, or a second login was started for the same profile or host. | Check the user code. After a second login, approve the newest code, and complete the newest login with its user code. |
 | `the login for profile ... was started with a different host` (or client ID, or scopes) | The second command does not use the host, `--client-id` or `--scopes` of the first one. | Complete the login with the same command that started it, plus `--user-code` and `--confirmation-code`. |
 | `no pending device code login for profile ...` | The login was already completed, or no login was started for this profile or host. | Start a new login. |
 | `--confirmation-code requires --user-code` | `--user-code` is missing from the command. | Add `--user-code` with the code from the first step. |

From 49bc70d652a74f5d7e5af6cf7965090675475069 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Fri, 30 Oct 2026 17:23:46 +0000
Subject: [PATCH 19/29] Say which prompts the non-interactive device code login
 skips

The second step can still show the workspace picker when it runs in a
terminal, so the comment no longer says that neither step prompts at all.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/login.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index d6ff5a7137f..94ae081bb0c 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -259,7 +259,8 @@ a new profile is created.
 		// is not a terminal, e.g. when an AI agent runs the login as a one-off
 		// command, nobody can type the code in. The non-interactive login then
 		// stores the device code, and a rerun of the command with --user-code
-		// and --confirmation-code completes the login. Neither step prompts.
+		// and --confirmation-code completes the login. Neither step prompts
+		// for the profile or the host.
 		var nonInteractive bool
 		if useDeviceCode {
 			if err := validateDeviceCodeLogin(ctx, cmd); err != nil {

From 293161363d39c95b7f3ff32cc437af857db05ef0 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Fri, 30 Oct 2026 17:24:48 +0000
Subject: [PATCH 20/29] Do not rewrite the token cache file when deleting a
 missing key

Every successful login now deletes the key of its pending device code
login, which is missing unless a non-interactive device code login was
started. Deleting a missing key rewrote token-cache.json anyway, so
logins without device code wrote the file one more time. Deleting a
missing key now leaves the file as it is.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 libs/auth/storage/filestore.go      |  3 +++
 libs/auth/storage/filestore_test.go | 18 ++++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/libs/auth/storage/filestore.go b/libs/auth/storage/filestore.go
index 18586a68ca4..64e4b02ab2e 100644
--- a/libs/auth/storage/filestore.go
+++ b/libs/auth/storage/filestore.go
@@ -135,6 +135,9 @@ func (c *fileStore) Delete(key string) error {
 	if err != nil {
 		return fmt.Errorf("load: %w", err)
 	}
+	if _, ok := f.Tokens[key]; !ok {
+		return nil
+	}
 	delete(f.Tokens, key)
 	return c.write(f)
 }
diff --git a/libs/auth/storage/filestore_test.go b/libs/auth/storage/filestore_test.go
index de5db01612b..855542e8f49 100644
--- a/libs/auth/storage/filestore_test.go
+++ b/libs/auth/storage/filestore_test.go
@@ -63,6 +63,24 @@ func TestStoreAndLookupPendingLogin(t *testing.T) {
 	}`, string(raw))
 }
 
+func TestDeleteMissingKeyDoesNotRewriteFile(t *testing.T) {
+	f := setup(t)
+	c, err := NewFileStore(t.Context(), WithFileLocation(f))
+	require.NoError(t, err)
+	// The store writes indented JSON, so a rewrite would change the file.
+	raw := `{"version":1,"tokens":{"x":{"access_token":"abc"}}}`
+	require.NoError(t, os.WriteFile(f, []byte(raw), ownerReadWrite))
+
+	require.NoError(t, c.Delete("y"))
+	got, err := os.ReadFile(f)
+	require.NoError(t, err)
+	assert.Equal(t, raw, string(got))
+
+	require.NoError(t, c.Delete("x"))
+	_, err = c.Lookup("x")
+	assert.ErrorIs(t, err, ErrNotFound)
+}
+
 func TestNoStoreFileReturnsErrNotConfigured(t *testing.T) {
 	l, err := NewFileStore(t.Context(), WithFileLocation(setup(t)))
 	require.NoError(t, err)

From 8856bdb7e359de91aaffbca24c5d7d9c70f52a8e Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Fri, 30 Oct 2026 17:26:24 +0000
Subject: [PATCH 21/29] Delete the pending device code login of any profile in
 auth logout

auth logout only cleared the token cache for profiles with auth_type
databricks-cli, so a device code login started for another profile, such
as a PAT profile, survived the logout and could still complete. The docs
say that logout removes the profile's pending login. Logout now deletes
it for every profile, and still leaves the tokens of other profiles alone.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 .../auth/logout/pending-device-code-login/output.txt  | 10 ++++++++++
 .../cmd/auth/logout/pending-device-code-login/script  | 11 +++++++++++
 cmd/auth/logout.go                                    |  7 +++++++
 3 files changed, 28 insertions(+)

diff --git a/acceptance/cmd/auth/logout/pending-device-code-login/output.txt b/acceptance/cmd/auth/logout/pending-device-code-login/output.txt
index b347f1321d4..2b000f667ce 100644
--- a/acceptance/cmd/auth/logout/pending-device-code-login/output.txt
+++ b/acceptance/cmd/auth/logout/pending-device-code-login/output.txt
@@ -7,6 +7,7 @@ Logged out of and deleted profile "dev".
 [
   "[DATABRICKS_URL]",
   "[DATABRICKS_URL]#device-code",
+  "pat#device-code",
   "staging",
   "staging#device-code"
 ]
@@ -16,4 +17,13 @@ Logged out of and deleted profile "dev".
 Logged out of profile "staging". Use --delete to also remove it from the config file.
 
 === Token cache keys after logout — no profile uses the host anymore
+[
+  "pat#device-code"
+]
+
+=== Logout pat, a profile that auth login did not create
+>>> [CLI] auth logout --profile pat --auto-approve
+No tokens to clear for profile "pat". Use --delete to remove it from the config file.
+
+=== Token cache keys after logout — the pending login of pat is removed
 []
diff --git a/acceptance/cmd/auth/logout/pending-device-code-login/script b/acceptance/cmd/auth/logout/pending-device-code-login/script
index 1d62f2cb572..32a2cc1d427 100644
--- a/acceptance/cmd/auth/logout/pending-device-code-login/script
+++ b/acceptance/cmd/auth/logout/pending-device-code-login/script
@@ -8,6 +8,10 @@ auth_type  = databricks-cli
 [staging]
 host = ${DATABRICKS_HOST}
 auth_type  = databricks-cli
+
+[pat]
+host = ${DATABRICKS_HOST}
+token = dapi-pat-token
 EOF
 
 mkdir -p "./home/.databricks"
@@ -19,6 +23,7 @@ cat > "./home/.databricks/token-cache.json" <<EOF
     "dev#device-code": {"pending_login": {"device_code": "dev-device-code", "user_code": "WDJBMJHT"}},
     "staging": {"access_token": "staging-cached-token", "token_type": "Bearer"},
     "staging#device-code": {"pending_login": {"device_code": "staging-device-code", "user_code": "WDJBMJHT"}},
+    "pat#device-code": {"pending_login": {"device_code": "pat-device-code", "user_code": "WDJBMJHT"}},
     "${DATABRICKS_HOST}": {"access_token": "shared-host-token", "token_type": "Bearer"},
     "${DATABRICKS_HOST}#device-code": {"pending_login": {"device_code": "host-device-code", "user_code": "WDJBMJHT"}}
   }
@@ -36,3 +41,9 @@ trace $CLI auth logout --profile staging --auto-approve
 
 title "Token cache keys after logout — no profile uses the host anymore\n"
 jq -S '.tokens | keys' "./home/.databricks/token-cache.json"
+
+title "Logout pat, a profile that auth login did not create"
+trace $CLI auth logout --profile pat --auto-approve
+
+title "Token cache keys after logout — the pending login of pat is removed\n"
+jq -S '.tokens | keys' "./home/.databricks/token-cache.json"
diff --git a/cmd/auth/logout.go b/cmd/auth/logout.go
index 7daf17be3e2..d3e0064194e 100644
--- a/cmd/auth/logout.go
+++ b/cmd/auth/logout.go
@@ -210,6 +210,13 @@ func runLogout(ctx context.Context, args logoutArgs) error {
 		if err != nil {
 			return fmt.Errorf("failed to clear token cache: %w", err)
 		}
+	} else {
+		// A device code login started for the profile could still complete
+		// and save a token for it.
+		err = args.tokenStore.Delete(pendingLoginKey(matchedProfile.Name))
+		if err != nil {
+			return fmt.Errorf("failed to delete pending device code login for profile %q: %w", matchedProfile.Name, err)
+		}
 	}
 
 	if args.deleteProfile {

From b69120e1bc122056194cbf31583e8b2f27762164 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Fri, 30 Oct 2026 17:27:04 +0000
Subject: [PATCH 22/29] Copy the scopes of a pending login in the memory store

The memory store copied the PendingLogin struct, but its Scopes slice
still shared the backing array with the caller, so changing the caller's
slice after Put changed the stored entry.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 libs/auth/storage/memory.go      |  2 ++
 libs/auth/storage/memory_test.go | 10 +++++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/libs/auth/storage/memory.go b/libs/auth/storage/memory.go
index d639cf5f108..99286259ef7 100644
--- a/libs/auth/storage/memory.go
+++ b/libs/auth/storage/memory.go
@@ -1,6 +1,7 @@
 package storage
 
 import (
+	"slices"
 	"sync"
 
 	"golang.org/x/oauth2"
@@ -31,6 +32,7 @@ func cloneEntry(e Entry) Entry {
 	e.Token = cloneToken(e.Token)
 	if e.PendingLogin != nil {
 		pending := *e.PendingLogin
+		pending.Scopes = slices.Clone(pending.Scopes)
 		e.PendingLogin = &pending
 	}
 	return e
diff --git a/libs/auth/storage/memory_test.go b/libs/auth/storage/memory_test.go
index 2a28d9b197a..0ba3e4d34c3 100644
--- a/libs/auth/storage/memory_test.go
+++ b/libs/auth/storage/memory_test.go
@@ -59,14 +59,22 @@ func TestMemoryStore_PutAndLookupUseCopies(t *testing.T) {
 
 func TestMemoryStore_PendingLoginUsesCopies(t *testing.T) {
 	s := NewMemoryStore()
-	pending := &PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}
+	pending := &PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT", Scopes: []string{"sql"}}
 	require.NoError(t, s.Put("key1", Entry{PendingLogin: pending}))
 
 	pending.DeviceCode = "mutated-after-store"
+	pending.Scopes[0] = "mutated-after-store"
 
 	got, err := s.Lookup("key1")
 	require.NoError(t, err)
 	assert.Equal(t, "device-code", got.PendingLogin.DeviceCode)
+	assert.Equal(t, []string{"sql"}, got.PendingLogin.Scopes)
+
+	got.PendingLogin.Scopes[0] = "mutated-after-lookup"
+
+	got, err = s.Lookup("key1")
+	require.NoError(t, err)
+	assert.Equal(t, []string{"sql"}, got.PendingLogin.Scopes)
 }
 
 func TestMemoryStore_Delete(t *testing.T) {

From 33e396aa5de146f6a43f62205363e312ea1263b3 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Fri, 30 Oct 2026 17:27:45 +0000
Subject: [PATCH 23/29] Use cmdio.MockDiscard in the device code login
 completion tests

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/login_device_code_test.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index 9608774fc6f..cbfc2aa5382 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -483,7 +483,7 @@ func TestLoginDeviceCodeRequestsScopes(t *testing.T) {
 func TestLoginDeviceCodeCompletesInTerminal(t *testing.T) {
 	server := newDeviceCodeServer(t)
 	setUpDeviceCodeLogin(t, "")
-	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), flags.OutputText, strings.NewReader(""), &bytes.Buffer{}, &bytes.Buffer{}, "", ""))
+	ctx := cmdio.MockDiscard(t.Context())
 	require.NoError(t, runDeviceCodeLogin(ctx, "--host", server.URL))
 
 	tm := termtest.Run(t, func(ctx context.Context) (struct{}, error) {
@@ -518,7 +518,7 @@ func TestLoginDeviceCodeCompletionChecksUserCode(t *testing.T) {
 		}
 	}
 	setUpDeviceCodeLogin(t, "")
-	ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), flags.OutputText, strings.NewReader(""), &bytes.Buffer{}, &bytes.Buffer{}, "", ""))
+	ctx := cmdio.MockDiscard(t.Context())
 	require.NoError(t, runDeviceCodeLogin(ctx, "--host", server.URL, "--profile", "test"))
 
 	err := runDeviceCodeLogin(ctx, "--host", server.URL, "--profile", "test", "--user-code", "AAAA-AAAA", "--confirmation-code", "FTFA-QQKY")
@@ -572,7 +572,7 @@ func TestLoginDeviceCodeCompletionChecksSettings(t *testing.T) {
 				}
 			}
 			setUpDeviceCodeLogin(t, "")
-			ctx := cmdio.InContext(t.Context(), cmdio.NewIO(t.Context(), flags.OutputText, strings.NewReader(""), &bytes.Buffer{}, &bytes.Buffer{}, "", ""))
+			ctx := cmdio.MockDiscard(t.Context())
 			require.NoError(t, runDeviceCodeLogin(ctx, append([]string{"--host", server.URL, "--profile", "test"}, tt.startArgs...)...))
 
 			host := server.URL

From 7f4e35aada0b849008167f9f7a9c484b51fb6378 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Mon, 2 Nov 2026 10:20:40 +0000
Subject: [PATCH 24/29] Ignore a token store error in the logout of a non-login
 profile

The logout of a profile that auth login did not create, e.g. a PAT
profile, failed when the token store could not delete its pending device
code login, e.g. with an unavailable keyring, and --delete then kept the
profile. Such a profile does not use the token store otherwise, so the
error is now only logged.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/logout.go      |  9 +++++----
 cmd/auth/logout_test.go | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/cmd/auth/logout.go b/cmd/auth/logout.go
index d3e0064194e..94813abbf4b 100644
--- a/cmd/auth/logout.go
+++ b/cmd/auth/logout.go
@@ -27,6 +27,7 @@ import (
 	"github.com/databricks/cli/libs/databrickscfg"
 	"github.com/databricks/cli/libs/databrickscfg/profile"
 	"github.com/databricks/cli/libs/env"
+	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/databricks-sdk-go/config"
 	"github.com/spf13/cobra"
 )
@@ -212,10 +213,10 @@ func runLogout(ctx context.Context, args logoutArgs) error {
 		}
 	} else {
 		// A device code login started for the profile could still complete
-		// and save a token for it.
-		err = args.tokenStore.Delete(pendingLoginKey(matchedProfile.Name))
-		if err != nil {
-			return fmt.Errorf("failed to delete pending device code login for profile %q: %w", matchedProfile.Name, err)
+		// and save a token for it. The profile does not use the token store
+		// otherwise, so an unavailable store does not fail its logout.
+		if err := args.tokenStore.Delete(pendingLoginKey(matchedProfile.Name)); err != nil {
+			log.Debugf(ctx, "Failed to delete the pending device code login: %v", err)
 		}
 	}
 
diff --git a/cmd/auth/logout_test.go b/cmd/auth/logout_test.go
index 366b2cc4e4e..2e2428e6cc9 100644
--- a/cmd/auth/logout_test.go
+++ b/cmd/auth/logout_test.go
@@ -2,6 +2,7 @@ package auth
 
 import (
 	"encoding/json"
+	"errors"
 	"maps"
 	"net/http"
 	"net/http/httptest"
@@ -256,6 +257,37 @@ func TestLogoutNoTokensWithDelete(t *testing.T) {
 	assert.Empty(t, profiles)
 }
 
+// failingDeleteStore fails every Delete, like a keyring that is unavailable.
+type failingDeleteStore struct {
+	*inMemoryStore
+}
+
+func (failingDeleteStore) Delete(string) error {
+	return errors.New("keyring unavailable")
+}
+
+// A profile that auth login did not create does not use the token store, so
+// an unavailable store does not fail its logout.
+func TestLogoutNonLoginProfileIgnoresTokenStoreError(t *testing.T) {
+	ctx := cmdio.MockDiscard(t.Context())
+	configPath := writeTempConfig(t, logoutTestConfig)
+	t.Setenv("DATABRICKS_CONFIG_FILE", configPath)
+
+	err := runLogout(ctx, logoutArgs{
+		profileName:    "my-m2m",
+		autoApprove:    true,
+		deleteProfile:  true,
+		profiler:       profile.DefaultProfiler,
+		tokenStore:     failingDeleteStore{&inMemoryStore{Tokens: map[string]*oauth2.Token{}}},
+		configFilePath: configPath,
+	})
+	require.NoError(t, err)
+
+	profiles, err := profile.DefaultProfiler.LoadProfiles(ctx, profile.WithName("my-m2m"))
+	require.NoError(t, err)
+	assert.Empty(t, profiles)
+}
+
 func TestLogoutProfileFlagAndPositionalArgConflict(t *testing.T) {
 	parent := &cobra.Command{Use: "root"}
 	parent.PersistentFlags().StringP("profile", "p", "", "~/.databrickscfg profile")

From 03ff5f9bdb4de51d6cbdf0645d66dc0b0f4aefe0 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Mon, 2 Nov 2026 10:23:33 +0000
Subject: [PATCH 25/29] Keep the pending device code login after a rate limited
 token request

Completing a non-interactive device code login deleted the pending login
when the server rate limited the token request, so an approved login had
to be started again. A rate limit can be lifted, so the pending login is
now kept, and the error asks to rerun the command later.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/README.md                 |  3 ++-
 cmd/auth/login_device_code.go      | 21 ++++++++++-----------
 cmd/auth/login_device_code_test.go | 22 +++++++++++++---------
 docs/device-code-login.md          |  2 +-
 libs/auth/u2m/device_code.go       |  3 +--
 5 files changed, 27 insertions(+), 24 deletions(-)

diff --git a/cmd/auth/README.md b/cmd/auth/README.md
index a1d56b7cc5f..1c0e2ff76bb 100644
--- a/cmd/auth/README.md
+++ b/cmd/auth/README.md
@@ -132,7 +132,8 @@ from, e.g., an agent's transcript cannot complete the login on another machine.
 Each target has one pending login, and a new login for it replaces the old
 one. The second step checks the user code, so a replaced login fails with a
 clear error without sending its confirmation code. A wrong confirmation code
-keeps the pending login for a rerun. A device code the server no longer knows
+or a rate limited token request keeps the pending login for a rerun. A device
+code the server no longer knows
 deletes it, and so does any successful login for the same target
 (`storeLoginToken`), with or without device code. The CLI does not expire
 pending logins itself: the server does. `auth logout` deletes the pending login
diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index 2e16595e71b..36adfabb4f7 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -235,20 +235,19 @@ func (l nonInteractiveDeviceCodeLogin) complete(ctx context.Context, userCode, c
 	if err != nil {
 		err = fmt.Errorf("token exchange: %w", err)
 	}
-	// The server no longer accepts an invalid or rate limited device code,
-	// so its pending login is deleted. A wrong confirmation code leaves the
-	// device code valid, so the pending login is kept for a rerun. After a
-	// successful exchange, storeLoginToken deletes it.
-	deviceCodeUnusable := errors.Is(err, u2m.ErrInvalidDeviceCode) || errors.Is(err, u2m.ErrDeviceCodeRateLimited)
-	if deviceCodeUnusable {
-		if err := l.tokenStore.Delete(l.key); err != nil {
-			log.Debugf(ctx, "Failed to delete the pending device code login: %v", err)
-		}
-	}
+	// The server no longer accepts an invalid device code, so its pending
+	// login is deleted. A wrong confirmation code leaves the device code
+	// valid, and a rate limit can be lifted, so the pending login is kept for
+	// a rerun. After a successful exchange, storeLoginToken deletes it.
 	switch {
 	case errors.Is(err, u2m.ErrInvalidConfirmationCode):
 		return nil, fmt.Errorf("%w. Check the confirmation code and approve the login if you haven't, then rerun this command. %s if it still fails", err, startNewLoginHint)
-	case deviceCodeUnusable:
+	case errors.Is(err, u2m.ErrDeviceCodeRateLimited):
+		return nil, fmt.Errorf("%w. Rerun this command later. %s if it still fails", err, startNewLoginHint)
+	case errors.Is(err, u2m.ErrInvalidDeviceCode):
+		if err := l.tokenStore.Delete(l.key); err != nil {
+			log.Debugf(ctx, "Failed to delete the pending device code login: %v", err)
+		}
 		return nil, fmt.Errorf("%w. %s", err, startNewLoginHint)
 	}
 	return token, err
diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index cbfc2aa5382..292ba910245 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -601,17 +601,21 @@ func TestLoginDeviceCodeCompletionWithSameHostInAnotherForm(t *testing.T) {
 	assert.NoError(t, err)
 }
 
-// The server keeps rejecting the token requests for a rate limited device
-// code, so its pending login is deleted.
+// A rate limit can be lifted, so the pending login of a rate limited token
+// request is kept for a rerun.
 func TestLoginDeviceCodeCompletionRateLimited(t *testing.T) {
 	server := testserver.New(t)
+	var tokenRequests atomic.Int32
 	// The router keeps the first handler registered for a route, so this one
-	// replaces the default token endpoint.
+	// replaces the default token endpoint. It rate limits the first request.
 	server.Handle("POST", "/oidc/v1/token", func(_ testserver.Request) any {
-		return testserver.Response{
-			StatusCode: http.StatusTooManyRequests,
-			Body:       map[string]string{"error": "invalid_request", "error_description": "Device grant rate limit exceeded"},
+		if tokenRequests.Add(1) == 1 {
+			return testserver.Response{
+				StatusCode: http.StatusTooManyRequests,
+				Body:       map[string]string{"error": "invalid_request", "error_description": "Device grant rate limit exceeded"},
+			}
 		}
+		return map[string]any{"access_token": "oauth-token", "expires_in": 3600, "token_type": "Bearer"}
 	})
 	testserver.AddDefaultHandlers(server)
 	setUpDeviceCodeLogin(t, "")
@@ -620,10 +624,10 @@ func TestLoginDeviceCodeCompletionRateLimited(t *testing.T) {
 
 	args := []string{"--host", server.URL, "--profile", "test", "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY"}
 	err := runDeviceCodeLogin(ctx, args...)
-	assert.EqualError(t, err, "token exchange: Device grant rate limit exceeded (error code: invalid_request). "+startNewLoginHint)
+	assert.EqualError(t, err, "token exchange: Device grant rate limit exceeded (error code: invalid_request). Rerun this command later. "+startNewLoginHint+" if it still fails")
 
-	err = runDeviceCodeLogin(ctx, args...)
-	assert.EqualError(t, err, "no pending device code login for profile test. "+startNewLoginHint)
+	require.NoError(t, runDeviceCodeLogin(ctx, args...))
+	assert.Equal(t, int32(2), tokenRequests.Load())
 }
 
 func TestLoginDeviceCodeCompletionWithoutHostSkipsPicker(t *testing.T) {
diff --git a/docs/device-code-login.md b/docs/device-code-login.md
index ea2949b050a..8588ab6b2e4 100644
--- a/docs/device-code-login.md
+++ b/docs/device-code-login.md
@@ -122,7 +122,7 @@ fail with a token refresh error and you need to run the login again.
 | `--configure-cluster is not supported by the non-interactive device code login` | The cluster picker needs a terminal. | Log in first, then set `cluster_id` on the profile. |
 | `token exchange: Invalid confirmation code (error code: invalid_request). Check the confirmation code ...` | The confirmation code was mistyped, or the login was not approved yet. | Check the code and approve the login, then run the command again. If it still fails, start a new login. |
 | `token exchange: Invalid device code (error code: invalid_request). Run the same command without --user-code and --confirmation-code ...` | The login expired. | Start a new login. |
-| `token exchange: Device grant rate limit exceeded (error code: invalid_request). Run the same command without --user-code and --confirmation-code ...` | Too many confirmation codes were sent for this login. | Start a new login. |
+| `token exchange: Device grant rate limit exceeded (error code: invalid_request). Rerun this command later ...` | Too many confirmation codes were sent for this login. | Run the command again later. If it still fails, start a new login. |
 | `--user-code does not match the pending login for profile ...` | The user code was mistyped or swapped with the confirmation code, or a second login was started for the same profile or host. | Check the user code. After a second login, approve the newest code, and complete the newest login with its user code. |
 | `the login for profile ... was started with a different host` (or client ID, or scopes) | The second command does not use the host, `--client-id` or `--scopes` of the first one. | Complete the login with the same command that started it, plus `--user-code` and `--confirmation-code`. |
 | `no pending device code login for profile ...` | The login was already completed, or no login was started for this profile or host. | Start a new login. |
diff --git a/libs/auth/u2m/device_code.go b/libs/auth/u2m/device_code.go
index e929c5c21f9..08966cd14af 100644
--- a/libs/auth/u2m/device_code.go
+++ b/libs/auth/u2m/device_code.go
@@ -43,8 +43,7 @@ var ErrInvalidConfirmationCode = errors.New("invalid confirmation code")
 var ErrInvalidDeviceCode = errors.New("invalid device code")
 
 // ErrDeviceCodeRateLimited matches the token exchange error for a device code
-// the server received too many token requests for. The login has to be
-// started again.
+// the server received too many token requests for.
 var ErrDeviceCodeRateLimited = errors.New("device code rate limited")
 
 // DeviceAuthorization holds what the user needs to approve a device code

From 7d8de6feeccaf727601d2bc0f69db7709400a400 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Mon, 2 Nov 2026 12:18:53 +0000
Subject: [PATCH 26/29] Compare the scopes of a pending device code login in
 any order

Completing a non-interactive device code login failed with "started with
different scopes" when --scopes listed the same scopes in another order
than the first step. The scopes are now compared as a set.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/login_device_code.go      | 11 ++++++++++-
 cmd/auth/login_device_code_test.go | 12 ++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index 36adfabb4f7..efb35d2268f 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -261,12 +261,21 @@ func (l nonInteractiveDeviceCodeLogin) changedSetting(pending storage.PendingLog
 		return "a different host"
 	case pending.ClientID != l.clientID:
 		return "a different client ID"
-	case !slices.Equal(pending.Scopes, l.scopes):
+	case !sameScopes(pending.Scopes, l.scopes):
 		return "different scopes"
 	}
 	return ""
 }
 
+// sameScopes reports whether two scope lists request the same scopes, in any
+// order, like --scopes does.
+func sameScopes(a, b []string) bool {
+	a, b = slices.Clone(a), slices.Clone(b)
+	slices.Sort(a)
+	slices.Sort(b)
+	return slices.Equal(slices.Compact(a), slices.Compact(b))
+}
+
 // sameCode reports whether two device codes match when compared the way the
 // user enters them.
 func sameCode(a, b string) bool {
diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index 292ba910245..a67995182b7 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -601,6 +601,18 @@ func TestLoginDeviceCodeCompletionWithSameHostInAnotherForm(t *testing.T) {
 	assert.NoError(t, err)
 }
 
+// The scopes of the second step can be listed in another order, because
+// they request the same scopes.
+func TestLoginDeviceCodeCompletionWithSameScopesInAnotherOrder(t *testing.T) {
+	server := newDeviceCodeServer(t)
+	setUpDeviceCodeLogin(t, "")
+	ctx := cmdio.MockDiscard(t.Context())
+	require.NoError(t, runDeviceCodeLogin(ctx, "--host", server.URL, "--scopes", "sql,all-apis"))
+
+	err := runDeviceCodeLogin(ctx, "--host", server.URL, "--scopes", "all-apis,sql", "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY")
+	assert.NoError(t, err)
+}
+
 // A rate limit can be lifted, so the pending login of a rate limited token
 // request is kept for a rerun.
 func TestLoginDeviceCodeCompletionRateLimited(t *testing.T) {

From dd9cf580e0a59564bf8ef657f271c595fc840aa2 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Mon, 2 Nov 2026 12:18:55 +0000
Subject: [PATCH 27/29] Delete the pending device code login only when it
 completes

Every successful login, including the browser login, deleted the pending
device code login of its profile or host, which added a token store
write, and a keyring call in secure mode, to every login. The pending
login is now deleted when its device code is exchanged, because the
server no longer accepts the device code afterwards. Other logins for the
same target keep it.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/README.md            |  9 ++++-----
 cmd/auth/login.go             |  5 -----
 cmd/auth/login_device_code.go | 22 +++++++++++++++-------
 cmd/auth/login_test.go        | 18 ------------------
 docs/device-code-login.md     |  4 ++--
 5 files changed, 21 insertions(+), 37 deletions(-)

diff --git a/cmd/auth/README.md b/cmd/auth/README.md
index 1c0e2ff76bb..acc3b50178a 100644
--- a/cmd/auth/README.md
+++ b/cmd/auth/README.md
@@ -132,11 +132,10 @@ from, e.g., an agent's transcript cannot complete the login on another machine.
 Each target has one pending login, and a new login for it replaces the old
 one. The second step checks the user code, so a replaced login fails with a
 clear error without sending its confirmation code. A wrong confirmation code
-or a rate limited token request keeps the pending login for a rerun. A device
-code the server no longer knows
-deletes it, and so does any successful login for the same target
-(`storeLoginToken`), with or without device code. The CLI does not expire
-pending logins itself: the server does. `auth logout` deletes the pending login
+or a rate limited token request keeps the pending login for a rerun. Completing
+the login deletes it, and so does a device code the server no longer knows.
+Other logins for the same target leave it. The CLI does not expire pending
+logins itself: the server does. `auth logout` deletes the pending login
 of the profile, and the one of its host when it deletes the host's token. A
 pending login for a profile that was never saved, or for a host that no profile
 uses, stays until a new login for it replaces it.
diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index 94ae081bb0c..983625a5a96 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -134,11 +134,6 @@ func storeLoginToken(ctx context.Context, tokenStore storage.Store, mode storage
 		}
 		return storeErr
 	}
-	// A pending device code login for the same profile or host is left over
-	// once a login succeeds.
-	if err := tokenStore.Delete(pendingLoginKey(key)); err != nil {
-		log.Debugf(ctx, "Failed to delete the pending device code login: %v", err)
-	}
 	storage.PinSecureMode(ctx, mode, storage.StorageModeUnknown)
 	return nil
 }
diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index efb35d2268f..9345ce6cb1b 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -235,24 +235,32 @@ func (l nonInteractiveDeviceCodeLogin) complete(ctx context.Context, userCode, c
 	if err != nil {
 		err = fmt.Errorf("token exchange: %w", err)
 	}
-	// The server no longer accepts an invalid device code, so its pending
-	// login is deleted. A wrong confirmation code leaves the device code
-	// valid, and a rate limit can be lifted, so the pending login is kept for
-	// a rerun. After a successful exchange, storeLoginToken deletes it.
+	// The server no longer accepts a device code that it exchanged for a
+	// token or considers invalid, so its pending login is deleted. A wrong
+	// confirmation code leaves the device code valid, and a rate limit can be
+	// lifted, so the pending login is kept for a rerun.
 	switch {
+	case err == nil:
+		l.deletePendingLogin(ctx)
 	case errors.Is(err, u2m.ErrInvalidConfirmationCode):
 		return nil, fmt.Errorf("%w. Check the confirmation code and approve the login if you haven't, then rerun this command. %s if it still fails", err, startNewLoginHint)
 	case errors.Is(err, u2m.ErrDeviceCodeRateLimited):
 		return nil, fmt.Errorf("%w. Rerun this command later. %s if it still fails", err, startNewLoginHint)
 	case errors.Is(err, u2m.ErrInvalidDeviceCode):
-		if err := l.tokenStore.Delete(l.key); err != nil {
-			log.Debugf(ctx, "Failed to delete the pending device code login: %v", err)
-		}
+		l.deletePendingLogin(ctx)
 		return nil, fmt.Errorf("%w. %s", err, startNewLoginHint)
 	}
 	return token, err
 }
 
+// deletePendingLogin deletes the pending login. A pending login that is left
+// over only fails a rerun of the second step, so an error is only logged.
+func (l nonInteractiveDeviceCodeLogin) deletePendingLogin(ctx context.Context) {
+	if err := l.tokenStore.Delete(l.key); err != nil {
+		log.Debugf(ctx, "Failed to delete the pending device code login: %v", err)
+	}
+}
+
 // changedSetting describes the setting that differs from the one pending was
 // started with, or returns "" if none does.
 func (l nonInteractiveDeviceCodeLogin) changedSetting(pending storage.PendingLogin) string {
diff --git a/cmd/auth/login_test.go b/cmd/auth/login_test.go
index 711ff907f0d..01f58c56cff 100644
--- a/cmd/auth/login_test.go
+++ b/cmd/auth/login_test.go
@@ -73,24 +73,6 @@ func TestStoreLoginTokenDeletesStaleTokenOnFailure(t *testing.T) {
 	assert.ErrorIs(t, err, storage.ErrNotFound)
 }
 
-func TestStoreLoginTokenDeletesPendingDeviceCodeLogin(t *testing.T) {
-	const profileName = "TEST"
-	store := storage.NewMemoryStore()
-	pending := storage.Entry{PendingLogin: &storage.PendingLogin{DeviceCode: "device-code", UserCode: "WDJBMJHT"}}
-	require.NoError(t, store.Put(pendingLoginKey(profileName), pending))
-	require.NoError(t, store.Put(pendingLoginKey("OTHER"), pending))
-	arg, err := u2m.NewProfileWorkspaceOAuthArgument("https://workspace.example.test", profileName)
-	require.NoError(t, err)
-
-	err = storeLoginToken(t.Context(), store, storage.StorageModeSecure, arg, &oauth2.Token{AccessToken: "new-token"})
-
-	require.NoError(t, err)
-	_, err = store.Lookup(pendingLoginKey(profileName))
-	assert.ErrorIs(t, err, storage.ErrNotFound)
-	_, err = store.Lookup(pendingLoginKey("OTHER"))
-	assert.NoError(t, err)
-}
-
 // logBuffer is a thread-safe bytes.Buffer for capturing log output in tests.
 type logBuffer struct {
 	mu  sync.Mutex
diff --git a/docs/device-code-login.md b/docs/device-code-login.md
index 8588ab6b2e4..97338a8a8ea 100644
--- a/docs/device-code-login.md
+++ b/docs/device-code-login.md
@@ -96,8 +96,8 @@ Each profile, or host without a profile, has one pending login. Starting a
 second login for it replaces the first, so complete one login before starting
 another.
 
-A successful login for the profile, in any way, and `databricks auth logout`
-remove its pending login.
+Completing the login and `databricks auth logout` remove its pending login.
+Other logins for the profile, e.g. in a browser, keep it.
 
 `--configure-cluster` is not supported by the non-interactive login. Set
 `cluster_id` on the profile after the login.

From a12cb57c43c37788409340accca49ef1608f07a1 Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Mon, 2 Nov 2026 12:26:50 +0000
Subject: [PATCH 28/29] Issue a new user code for every device code login in
 the fake server

The fake server issued the same user code for every login, so the
acceptance tests edited token-cache.json with update_file.py to tell
logins apart. It now issues WDJB0001, WDJB0002, ... in order, like the
real server issues a new user code for every login, and the tests use the
codes it issues.

The test of a device code the server no longer knows restores the
pending login from before its device code was exchanged, instead of
replacing the device code in the cache file.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 .../non-interactive/concurrent/output.txt     | 12 +++----
 .../non-interactive/concurrent/script         | 14 ++++----
 .../non-interactive/errors/output.txt         | 36 +++++++++++--------
 .../device-code/non-interactive/errors/script | 36 ++++++++++---------
 .../non-interactive/flags/output.txt          | 12 +++----
 .../device-code/non-interactive/flags/script  |  4 +--
 .../non-interactive/nominal/output.txt        | 18 +++++-----
 .../non-interactive/nominal/script            |  6 ++--
 cmd/auth/login_device_code_test.go            | 12 +++----
 libs/testserver/fake_oidc.go                  | 11 ++++--
 10 files changed, 87 insertions(+), 74 deletions(-)

diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt
index 498231147f1..e1f6ae679bd 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/output.txt
@@ -5,17 +5,15 @@
 
 >>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
 
->>> update_file.py home/.databricks/token-cache.json WDJBMJHT NEWRCODE
-
 >>> cache_keys
 [
   "test#device-code"
 ]
 
->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 Error: --user-code does not match the pending login for profile test. Check the user code. If you started a newer login, complete it with its user code. Run the same command without --user-code and --confirmation-code to start a new login
 
->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code NEWR-CODE --confirmation-code FTFA-QQKY
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0002 --confirmation-code FTFA-QQKY
 Profile test was successfully saved
 
 >>> print_requests.py --oneline //oidc/v1/token
@@ -38,12 +36,12 @@ Profile test was successfully saved
   "test"
 ]
 
->>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile b --use-device-code --user-code WDJB-0004 --confirmation-code FTFA-QQKY
 Profile b was successfully saved
 
->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-0005 --confirmation-code FTFA-QQKY
 
->>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile a --use-device-code --user-code WDJB-0003 --confirmation-code FTFA-QQKY
 Profile a was successfully saved
 
 >>> cache_keys
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/script b/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/script
index 97ade6f94d2..db75e365a89 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/script
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/concurrent/script
@@ -1,14 +1,12 @@
 sethome "./home"
 
-# The real server issues a new user code for every login, while the fake server
-# issues the same one. The script gives the second login its own user code.
+# The fake server issues the user codes WDJB0001, WDJB0002, ... in order.
 title "A second login for the same profile replaces the first\n"
 start_login LOG.first $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code
 start_login LOG.second $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code
-trace update_file.py home/.databricks/token-cache.json WDJBMJHT NEWRCODE
 trace cache_keys
-trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
-trace $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code NEWR-CODE --confirmation-code FTFA-QQKY
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
+trace $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-0002 --confirmation-code FTFA-QQKY
 trace print_requests.py --oneline //oidc/v1/token
 
 title "Logins for different targets are independent\n"
@@ -16,8 +14,8 @@ start_login LOG.a $CLI auth login --host $DATABRICKS_HOST --profile a --use-devi
 start_login LOG.b $CLI auth login --host $DATABRICKS_HOST --profile b --use-device-code
 start_login LOG.host $CLI auth login --host $DATABRICKS_HOST --use-device-code
 trace cache_keys
-trace $CLI auth login --host $DATABRICKS_HOST --profile b --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
-trace $CLI auth login --host $DATABRICKS_HOST --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
-trace $CLI auth login --host $DATABRICKS_HOST --profile a --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace $CLI auth login --host $DATABRICKS_HOST --profile b --use-device-code --user-code WDJB-0004 --confirmation-code FTFA-QQKY
+trace $CLI auth login --host $DATABRICKS_HOST --use-device-code --user-code WDJB-0005 --confirmation-code FTFA-QQKY
+trace $CLI auth login --host $DATABRICKS_HOST --profile a --use-device-code --user-code WDJB-0003 --confirmation-code FTFA-QQKY
 trace cache_keys
 trace print_requests.py --oneline //oidc/v1/token
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
index 19505cddaa8..d299e0be717 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/errors/output.txt
@@ -4,7 +4,7 @@
 >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
 Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
 
->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 Error: --use-device-code is experimental. Set DATABRICKS_CLI_DEVICE_CODE=true to enable it
 
 === Flags the non-interactive login cannot honor
@@ -17,7 +17,7 @@ Error: --configure-cluster is not supported by the non-interactive device code l
 >>> musterr [CLI] auth login --use-device-code
 Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
 
->>> musterr [CLI] auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> musterr [CLI] auth login --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 Error: --use-device-code requires a workspace host. Pass it as an argument or with --host
 
 === Incomplete flags of the second step
@@ -25,10 +25,10 @@ Error: --use-device-code requires a workspace host. Pass it as an argument or wi
 >>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --confirmation-code FTFA-QQKY
 Error: --confirmation-code requires --user-code
 
->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0001
 Error: --user-code requires --confirmation-code
 
->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 Error: --confirmation-code requires --use-device-code
 
 === Profile name that marks a pending login
@@ -38,47 +38,52 @@ Error: profile name "test#device-code" must not end with #device-code, which mar
 
 === Account host
 
->>> musterr [CLI] auth login --host https://accounts.cloud.databricks.test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> musterr [CLI] auth login --host https://accounts.cloud.databricks.test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 Warn: [hostmetadata] failed to fetch host metadata for https://accounts.cloud.databricks.test, will skip for 1m0s
 Error: --use-device-code is only supported for workspace hosts
 
 === Profile scoped to resources
 
->>> musterr [CLI] auth login --profile resources --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> musterr [CLI] auth login --profile resources --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 Error: --use-device-code cannot be used with profile resources because its login is scoped to resources. Log in without --use-device-code
 
 === No pending login
 
->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 Error: no pending device code login for profile test. Run the same command without --user-code and --confirmation-code to start a new login
 
->>> musterr [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 Error: no pending device code login for host [DATABRICKS_URL]. Run the same command without --user-code and --confirmation-code to start a new login
 
 >>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
 
 === Wrong confirmation code
 
->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code AAAA-AAAA
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0001 --confirmation-code AAAA-AAAA
 Error: token exchange: Invalid confirmation code (error code: invalid_request). Check the confirmation code and approve the login if you haven't, then rerun this command. Run the same command without --user-code and --confirmation-code to start a new login if it still fails
 
 === Rerun with the right confirmation code
 
->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code wdjb-mjht --confirmation-code ftfa-qqky
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code wdjb-0001 --confirmation-code ftfa-qqky
 Profile test was successfully saved
 
 === Rerun after the login was completed
 
->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 Error: no pending device code login for profile test. Run the same command without --user-code and --confirmation-code to start a new login
 
 === Device code unknown to the server
 
 >>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code
 
->>> update_file.py home/.databricks/token-cache.json device-code-2 unknown-device-code
+>>> cp home/.databricks/token-cache.json home/token-cache.pending.json
 
->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0002 --confirmation-code FTFA-QQKY
+Profile test was successfully saved
+
+>>> cp home/token-cache.pending.json home/.databricks/token-cache.json
+
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0002 --confirmation-code FTFA-QQKY
 Error: token exchange: Invalid device code (error code: invalid_request). Run the same command without --user-code and --confirmation-code to start a new login
 
 >>> cache_keys
@@ -91,7 +96,7 @@ Error: token exchange: Invalid device code (error code: invalid_request). Run th
 
 >>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --scopes sql
 
->>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> musterr [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0003 --confirmation-code FTFA-QQKY
 Error: the login for profile test was started with different scopes. Complete it with the same command that started it. Run the same command without --user-code and --confirmation-code to start a new login
 
 >>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
@@ -99,5 +104,6 @@ Error: the login for profile test was started with different scopes. Complete it
 {"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=AAAAAAAA&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
 {"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-1&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
 {"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+all-apis"}
-{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=unknown-device-code&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
+{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
+{"method": "POST", "path": "/oidc/v1/token", "raw_body": "client_id=databricks-cli&confirmation_code=FTFAQQKY&device_code=device-code-2&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code"}
 {"method": "POST", "path": "/oidc/v1/device/auth", "raw_body": "client_id=databricks-cli&scope=offline_access+sql"}
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/errors/script b/acceptance/cmd/auth/login/device-code/non-interactive/errors/script
index 76e79bddad8..02d972a67ee 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/errors/script
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/errors/script
@@ -4,7 +4,7 @@ title "Device code login is disabled by default\n"
 (
     unset DATABRICKS_CLI_DEVICE_CODE
     trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code
-    trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+    trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 )
 
 title "Flags the non-interactive login cannot honor\n"
@@ -13,53 +13,57 @@ trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-devic
 # The non-interactive login cannot answer the profile picker or the host prompt.
 title "Missing host\n"
 trace musterr $CLI auth login --use-device-code
-trace musterr $CLI auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace musterr $CLI auth login --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 
 title "Incomplete flags of the second step\n"
 trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --confirmation-code FTFA-QQKY
-trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT
-trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-0001
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 
 title "Profile name that marks a pending login\n"
 trace musterr $CLI auth login --host $DATABRICKS_HOST --profile 'test#device-code' --use-device-code
 
 title "Account host\n"
-trace musterr $CLI auth login --host https://accounts.cloud.databricks.test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace musterr $CLI auth login --host https://accounts.cloud.databricks.test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 
 envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
 
 title "Profile scoped to resources\n"
-trace musterr $CLI auth login --profile resources --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace musterr $CLI auth login --profile resources --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 
 title "No pending login\n"
-trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
-trace musterr $CLI auth login --host $DATABRICKS_HOST --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
+trace musterr $CLI auth login --host $DATABRICKS_HOST --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 
 start_login LOG.wrong-code $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code
 
 title "Wrong confirmation code\n"
-trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code AAAA-AAAA
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-0001 --confirmation-code AAAA-AAAA
 
 # A wrong confirmation code leaves the device code valid, so the pending
 # login is kept.
 title "Rerun with the right confirmation code\n"
-trace $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code wdjb-mjht --confirmation-code ftfa-qqky
+trace $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code wdjb-0001 --confirmation-code ftfa-qqky
 
 title "Rerun after the login was completed\n"
-trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 
-# The server discards the device code when the login expires. The pending
-# login is then deleted.
+# The server discards the device code when the login expires. The fake server
+# only discards a device code once it is exchanged, so a pending login restored
+# from before the exchange stands in for an expired one. The pending login is
+# then deleted.
 title "Device code unknown to the server\n"
 start_login LOG.expired $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code
-trace update_file.py home/.databricks/token-cache.json device-code-2 unknown-device-code
-trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace cp home/.databricks/token-cache.json home/token-cache.pending.json
+trace $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-0002 --confirmation-code FTFA-QQKY
+trace cp home/token-cache.pending.json home/.databricks/token-cache.json
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-0002 --confirmation-code FTFA-QQKY
 trace cache_keys
 
 # The token gets the scopes of the device authorization, so the second step
 # cannot change them.
 title "Scopes changed between the steps\n"
 start_login LOG.scopes $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --scopes sql
-trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace musterr $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-0003 --confirmation-code FTFA-QQKY
 
 trace print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/flags/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/flags/output.txt
index a39e6a70953..3321a886fd6 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/flags/output.txt
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/flags/output.txt
@@ -6,13 +6,13 @@ Using a browser on another device, visit:
 [DATABRICKS_URL]/device/verification
 
 And enter the code:
-WDJB-MJHT
+WDJB-0001
 
 Once finished, complete the login by running the same command with
---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
+--user-code WDJB-0001 and --confirmation-code set to the confirmation code
 provided in your browser.
 
->>> [CLI] auth login --profile scoped --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> [CLI] auth login --profile scoped --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 Profile scoped was successfully saved
 
 >>> print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
@@ -26,11 +26,11 @@ Using a browser on another device, visit:
 [DATABRICKS_URL]/device/verification
 
 And enter the code:
-WDJB-MJHT
+WDJB-0002
 
 Once finished, complete the login by running the same command with
---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
+--user-code WDJB-0002 and --confirmation-code set to the confirmation code
 provided in your browser.
 
->>> [CLI] auth login --host [DATABRICKS_URL] --profile serverless --use-device-code --configure-serverless --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile serverless --use-device-code --configure-serverless --user-code WDJB-0002 --confirmation-code FTFA-QQKY
 Profile serverless was successfully saved
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/flags/script b/acceptance/cmd/auth/login/device-code/non-interactive/flags/script
index 4824729081c..2841f3c6ce8 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/flags/script
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/flags/script
@@ -5,12 +5,12 @@ envsubst < "./home/.databrickscfg.tmpl" > "./home/.databrickscfg"
 # step, so the token exchange uses the client ID of the profile.
 title "Scopes and client ID from the profile\n"
 trace $CLI auth login --profile scoped --use-device-code
-trace $CLI auth login --profile scoped --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace $CLI auth login --profile scoped --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 trace print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
 
 # Only the second step saves the profile.
 title "Serverless compute is configured in the second step\n"
 trace $CLI auth login --host $DATABRICKS_HOST --profile serverless --use-device-code --configure-serverless
-trace $CLI auth login --host $DATABRICKS_HOST --profile serverless --use-device-code --configure-serverless --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace $CLI auth login --host $DATABRICKS_HOST --profile serverless --use-device-code --configure-serverless --user-code WDJB-0002 --confirmation-code FTFA-QQKY
 
 mv "./home/.databrickscfg" "./out.databrickscfg"
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt
index 5a70dc2fd0c..93d79138488 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/output.txt
@@ -6,10 +6,10 @@ Using a browser on another device, visit:
 [DATABRICKS_URL]/device/verification
 
 And enter the code:
-WDJB-MJHT
+WDJB-0001
 
 Once finished, complete the login by running the same command with
---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
+--user-code WDJB-0001 and --confirmation-code set to the confirmation code
 provided in your browser.
 
 === The first step stores the device code and saves no profile
@@ -24,7 +24,7 @@ home/.databricks/token-cache.json
 
 === Confirm the login
 
->>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> [CLI] auth login --host [DATABRICKS_URL] --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 
 >>> [CLI] auth token --host [DATABRICKS_URL]
 json.access_token = "oauth-token";
@@ -41,15 +41,15 @@ Using a browser on another device, visit:
 [DATABRICKS_URL]/device/verification
 
 And enter the code:
-WDJB-MJHT
+WDJB-0002
 
 Once finished, complete the login by running the same command with
---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
+--user-code WDJB-0002 and --confirmation-code set to the confirmation code
 provided in your browser.
 
 === Confirm the login
 
->>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile test --use-device-code --user-code WDJB-0002 --confirmation-code FTFA-QQKY
 Profile test was successfully saved
 
 >>> [CLI] auth token --profile test
@@ -66,16 +66,16 @@ Using a browser on another device, visit:
 [DATABRICKS_URL]/device/verification
 
 And enter the code:
-WDJB-MJHT
+WDJB-0003
 
 Once finished, complete the login by running the same command with
---user-code WDJB-MJHT and --confirmation-code set to the confirmation code
+--user-code WDJB-0003 and --confirmation-code set to the confirmation code
 provided in your browser.
 
 >>> [CLI] auth token --profile test
 json.access_token = "oauth-token";
 
->>> [CLI] auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+>>> [CLI] auth login --profile test --use-device-code --user-code WDJB-0003 --confirmation-code FTFA-QQKY
 Profile test was successfully saved
 
 >>> cache_keys
diff --git a/acceptance/cmd/auth/login/device-code/non-interactive/nominal/script b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/script
index 2f00d282b27..69f9a349da6 100644
--- a/acceptance/cmd/auth/login/device-code/non-interactive/nominal/script
+++ b/acceptance/cmd/auth/login/device-code/non-interactive/nominal/script
@@ -10,7 +10,7 @@ trace find.py home
 trace cache_keys
 
 title "Confirm the login\n"
-trace $CLI auth login --host $DATABRICKS_HOST --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace $CLI auth login --host $DATABRICKS_HOST --use-device-code --user-code WDJB-0001 --confirmation-code FTFA-QQKY
 trace $CLI auth token --host $DATABRICKS_HOST | gron.py | grep access_token
 trace cache_keys
 
@@ -18,7 +18,7 @@ title "Start the login with a profile\n"
 trace $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code
 
 title "Confirm the login\n"
-trace $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace $CLI auth login --host $DATABRICKS_HOST --profile test --use-device-code --user-code WDJB-0002 --confirmation-code FTFA-QQKY
 trace $CLI auth token --profile test | gron.py | grep access_token
 trace $CLI auth profiles
 
@@ -27,7 +27,7 @@ trace $CLI auth profiles
 title "Start the login again with the host from the saved profile\n"
 trace $CLI auth login --profile test --use-device-code
 trace $CLI auth token --profile test | gron.py | grep access_token
-trace $CLI auth login --profile test --use-device-code --user-code WDJB-MJHT --confirmation-code FTFA-QQKY
+trace $CLI auth login --profile test --use-device-code --user-code WDJB-0003 --confirmation-code FTFA-QQKY
 trace cache_keys
 trace print_requests.py --oneline //oidc/v1/device/auth //oidc/v1/token
 
diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index a67995182b7..7aee9c30218 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -487,7 +487,7 @@ func TestLoginDeviceCodeCompletesInTerminal(t *testing.T) {
 	require.NoError(t, runDeviceCodeLogin(ctx, "--host", server.URL))
 
 	tm := termtest.Run(t, func(ctx context.Context) (struct{}, error) {
-		return struct{}{}, runDeviceCodeLogin(ctx, "--host", server.URL, "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY")
+		return struct{}{}, runDeviceCodeLogin(ctx, "--host", server.URL, "--user-code", "WDJB-0001", "--confirmation-code", "FTFA-QQKY")
 	})
 	_, err := tm.Result()
 	require.NoError(t, err)
@@ -527,7 +527,7 @@ func TestLoginDeviceCodeCompletionChecksUserCode(t *testing.T) {
 
 	// The pending login is kept, and the user code is compared the way the
 	// user enters it.
-	require.NoError(t, runDeviceCodeLogin(ctx, "--host", server.URL, "--profile", "test", "--user-code", "wdjbmjht", "--confirmation-code", "FTFA-QQKY"))
+	require.NoError(t, runDeviceCodeLogin(ctx, "--host", server.URL, "--profile", "test", "--user-code", "wdjb0001", "--confirmation-code", "FTFA-QQKY"))
 	assert.Equal(t, int32(1), tokenRequests.Load())
 }
 
@@ -581,7 +581,7 @@ func TestLoginDeviceCodeCompletionChecksSettings(t *testing.T) {
 				other.RequestCallback = server.RequestCallback
 				host = other.URL
 			}
-			args := append([]string{"--host", host, "--profile", "test", "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY"}, tt.completeArgs...)
+			args := append([]string{"--host", host, "--profile", "test", "--user-code", "WDJB-0001", "--confirmation-code", "FTFA-QQKY"}, tt.completeArgs...)
 			err := runDeviceCodeLogin(ctx, args...)
 			assert.EqualError(t, err, "the login for profile test was started with "+tt.wantChanged+". Complete it with the same command that started it. "+startNewLoginHint)
 			assert.Zero(t, tokenRequests.Load())
@@ -597,7 +597,7 @@ func TestLoginDeviceCodeCompletionWithSameHostInAnotherForm(t *testing.T) {
 	ctx := cmdio.MockDiscard(t.Context())
 	require.NoError(t, runDeviceCodeLogin(ctx, "--host", server.URL))
 
-	err := runDeviceCodeLogin(ctx, "--host", server.URL+"/browse", "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY")
+	err := runDeviceCodeLogin(ctx, "--host", server.URL+"/browse", "--user-code", "WDJB-0001", "--confirmation-code", "FTFA-QQKY")
 	assert.NoError(t, err)
 }
 
@@ -609,7 +609,7 @@ func TestLoginDeviceCodeCompletionWithSameScopesInAnotherOrder(t *testing.T) {
 	ctx := cmdio.MockDiscard(t.Context())
 	require.NoError(t, runDeviceCodeLogin(ctx, "--host", server.URL, "--scopes", "sql,all-apis"))
 
-	err := runDeviceCodeLogin(ctx, "--host", server.URL, "--scopes", "all-apis,sql", "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY")
+	err := runDeviceCodeLogin(ctx, "--host", server.URL, "--scopes", "all-apis,sql", "--user-code", "WDJB-0001", "--confirmation-code", "FTFA-QQKY")
 	assert.NoError(t, err)
 }
 
@@ -634,7 +634,7 @@ func TestLoginDeviceCodeCompletionRateLimited(t *testing.T) {
 	ctx := cmdio.MockDiscard(t.Context())
 	require.NoError(t, runDeviceCodeLogin(ctx, "--host", server.URL, "--profile", "test"))
 
-	args := []string{"--host", server.URL, "--profile", "test", "--user-code", "WDJB-MJHT", "--confirmation-code", "FTFA-QQKY"}
+	args := []string{"--host", server.URL, "--profile", "test", "--user-code", "WDJB-0001", "--confirmation-code", "FTFA-QQKY"}
 	err := runDeviceCodeLogin(ctx, args...)
 	assert.EqualError(t, err, "token exchange: Device grant rate limit exceeded (error code: invalid_request). Rerun this command later. "+startNewLoginHint+" if it still fails")
 
diff --git a/libs/testserver/fake_oidc.go b/libs/testserver/fake_oidc.go
index 492b1967056..cf1593960f0 100644
--- a/libs/testserver/fake_oidc.go
+++ b/libs/testserver/fake_oidc.go
@@ -1,6 +1,7 @@
 package testserver
 
 import (
+	"fmt"
 	"net/http"
 	"net/url"
 	"slices"
@@ -15,7 +16,6 @@ const (
 	// Device code login is approved on another device, which acceptance tests
 	// cannot drive, so every device authorization is treated as approved with
 	// a fixed confirmation code that tests can type into the CLI.
-	fakeDeviceUserCode         = "WDJBMJHT"
 	fakeDeviceConfirmationCode = "FTFAQQKY"
 
 	// Like the real server, only allowlisted OAuth clients can use device code
@@ -67,7 +67,7 @@ func (s *FakeOidc) OidcDeviceAuth(req Request) Response {
 	return Response{
 		Body: map[string]any{
 			"device_code":      deviceCode,
-			"user_code":        fakeDeviceUserCode,
+			"user_code":        fakeDeviceUserCode(s.lastDeviceCode),
 			"verification_uri": s.url + "/device/verification",
 			"expires_in":       600,
 			"interval":         0,
@@ -75,6 +75,13 @@ func (s *FakeOidc) OidcDeviceAuth(req Request) Response {
 	}
 }
 
+// fakeDeviceUserCode returns the user code of the nth device authorization.
+// Like the real server, the fake issues a new user code for every login, in an
+// order that tests can rely on: WDJB0001, WDJB0002, and so on.
+func fakeDeviceUserCode(n int) string {
+	return fmt.Sprintf("WDJB%04d", n)
+}
+
 // deviceCodeToken exchanges a device code and confirmation code for a token.
 // Like the real server, a wrong confirmation code leaves the device code
 // valid, and a successful exchange consumes it.

From 275c55c6274879bfc7630d2f8a4c16ae6a5bc4ce Mon Sep 17 00:00:00 2001
From: Maksim Zuev <maksim.zuev@databricks.com>
Date: Mon, 2 Nov 2026 12:34:26 +0000
Subject: [PATCH 29/29] Simplify the checks of the non-interactive device code
 login

- Sort the scopes once when the login is set up, instead of sorting both
  lists in every comparison.
- Read --use-device-code from the command in
  validateDeviceCodeCompletionFlags instead of passing it in.

Co-authored-by: Isaac <no-reply@databricks.com>
---
 cmd/auth/login.go                  |  4 ++--
 cmd/auth/login_device_code.go      | 21 ++++++++-------------
 cmd/auth/login_device_code_test.go |  6 +++++-
 3 files changed, 15 insertions(+), 16 deletions(-)

diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index 983625a5a96..7552c7defcc 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -246,7 +246,7 @@ a new profile is created.
 			}
 		}
 
-		if err := validateDeviceCodeCompletionFlags(cmd, useDeviceCode); err != nil {
+		if err := validateDeviceCodeCompletionFlags(cmd); err != nil {
 			return err
 		}
 		completeLogin := cmd.Flags().Changed("confirmation-code")
@@ -479,7 +479,7 @@ a new profile is created.
 			profile:        profileName,
 			host:           (&config.Config{Host: authArguments.Host}).CanonicalHostName(),
 			clientID:       clientID,
-			scopes:         scopesList,
+			scopes:         slices.Sorted(slices.Values(scopesList)),
 		}
 		var token *oauth2.Token
 		switch {
diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go
index 9345ce6cb1b..ddbc2709d94 100644
--- a/cmd/auth/login_device_code.go
+++ b/cmd/auth/login_device_code.go
@@ -114,7 +114,11 @@ func deviceCodeLogin(ctx context.Context, persistentAuth *u2m.PersistentAuth) (*
 // validateDeviceCodeCompletionFlags returns an error if the flags that complete
 // a non-interactive device code login are not set together, or are set to an
 // empty code.
-func validateDeviceCodeCompletionFlags(cmd *cobra.Command, useDeviceCode bool) error {
+func validateDeviceCodeCompletionFlags(cmd *cobra.Command) error {
+	useDeviceCode, err := cmd.Flags().GetBool("use-device-code")
+	if err != nil {
+		return err
+	}
 	hasUserCode := cmd.Flags().Changed("user-code")
 	hasConfirmationCode := cmd.Flags().Changed("confirmation-code")
 	switch {
@@ -137,8 +141,8 @@ func validateDeviceCodeCompletionFlags(cmd *cobra.Command, useDeviceCode bool) e
 // that cannot read the confirmation code from stdin. The first step stores the
 // device code as a pending login under key, and the second step exchanges it,
 // so that the device code never leaves the machine. The host is canonical, like
-// the host in the cache key, so that the same host passed in another form
-// completes the login.
+// the host in the cache key, and the scopes are sorted, so that the same host
+// or scopes passed in another form complete the login.
 type nonInteractiveDeviceCodeLogin struct {
 	persistentAuth *u2m.PersistentAuth
 	tokenStore     storage.Store
@@ -269,21 +273,12 @@ func (l nonInteractiveDeviceCodeLogin) changedSetting(pending storage.PendingLog
 		return "a different host"
 	case pending.ClientID != l.clientID:
 		return "a different client ID"
-	case !sameScopes(pending.Scopes, l.scopes):
+	case !slices.Equal(pending.Scopes, l.scopes):
 		return "different scopes"
 	}
 	return ""
 }
 
-// sameScopes reports whether two scope lists request the same scopes, in any
-// order, like --scopes does.
-func sameScopes(a, b []string) bool {
-	a, b = slices.Clone(a), slices.Clone(b)
-	slices.Sort(a)
-	slices.Sort(b)
-	return slices.Equal(slices.Compact(a), slices.Compact(b))
-}
-
 // sameCode reports whether two device codes match when compared the way the
 // user enters them.
 func sameCode(a, b string) bool {
diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go
index 7aee9c30218..a55292e5420 100644
--- a/cmd/auth/login_device_code_test.go
+++ b/cmd/auth/login_device_code_test.go
@@ -389,13 +389,17 @@ func TestValidateDeviceCodeCompletionFlags(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			cmd := &cobra.Command{}
+			cmd.Flags().Bool("use-device-code", false, "")
 			cmd.Flags().String("user-code", "", "")
 			cmd.Flags().String("confirmation-code", "", "")
+			if tt.useDeviceCode {
+				require.NoError(t, cmd.Flags().Set("use-device-code", "true"))
+			}
 			for name, value := range tt.flags {
 				require.NoError(t, cmd.Flags().Set(name, value))
 			}
 
-			err := validateDeviceCodeCompletionFlags(cmd, tt.useDeviceCode)
+			err := validateDeviceCodeCompletionFlags(cmd)
 			if tt.wantErr != "" {
 				assert.EqualError(t, err, tt.wantErr)
 			} else {