Add passkey browser auth to CLI

[ntner]

What is the feature/update/fix?

Feature: Passkey Browser Authentication for the CLI

The CLI now completes two-factor console authentication through your browser. When a session token challenge is issued, the CLI opens the console's login page in your default browser, where the WebAuthn ceremony runs with whatever authenticator you use: a passkey (Touch ID, Windows Hello, or a synced passkey) or a USB security key. The signed assertion is returned to the CLI over a short-lived local callback and the command proceeds.

The direct USB security key path remains available behind an environment variable:

Variable	Values	Default	Effect
CONVOX_WEB_U2F_DISABLE	true / unset	unset	When true, skip the browser flow and authenticate directly against a physical USB security key (the previous behavior). Useful on headless machines with no browser.

---

How to use it?

Update your CLI, then use it as usual:

$ convox update

When a command requires the security token challenge, the CLI prints a link and opens your browser automatically. Complete the passkey or security key prompt in the browser, then return to the terminal; the CLI continues on its own. The browser must run on the same machine as the CLI, since the result is returned over a local callback. The browser step times out after 5 minutes.

On a headless machine, or to keep using a USB security key directly, set the variable in the environment of the commands you run:

$ export CONVOX_WEB_U2F_DISABLE=true

---

Does it have a breaking change?

No breaking changes to commands or configuration. The default authentication flow changes from the direct USB key path to the browser flow, which supports USB security keys as well as passkeys. If you prefer the direct USB flow or work without a browser, set CONVOX_WEB_U2F_DISABLE=true to keep the previous behavior.

---

Requirements

To use this feature, you must update your CLI to version 20260714094620 or newer.

• Check your CLI's version with convox version
• Update your CLI with convox update