Unable to generate API key when using External IdP (Azure AD)

[ametdoohan]

Kiro Product

IDE

Feature Description

Description:

Problem

I cannot generate a Kiro API key because the Kiro web portal (app.kiro.dev) does not support my authentication setup.

My Configuration

• Kiro Profile: Subscribed via AWS Amazon Q (us-east-1)
• Identity Management: External IdP (Microsoft Entra ID / Azure AD) with SCIM provisioning
• IAM Identity Center region: ap-southeast-3 (Jakarta) on different account but same orgs not supported by app.kiro.dev
• API Keys setting: Enabled by admin in Kiro console

Steps to Reproduce

1. Admin enables "API keys" toggle in Kiro console Settings → Kiro settings ✅
2. User goes to app.kiro.dev/signin
3. Clicks "Your organization"
4. Portal shows "Sign in with AWS IAM Identity Center" — requires Start URL and Region
5. My IAM Identity Center is in ap-southeast-3 which is not a supported region
6. There is no option to sign in with direct External IdP (Azure AD/Entra ID)

Expected Behavior

Users authenticated via External IdP should be able to sign in to app.kiro.dev and generate API keys, either by:

• Supporting direct External IdP login on the portal, OR
• Supporting all AWS regions for IAM Identity Center login, OR
• Providing an alternative way to generate API keys (e.g., via Kiro IDE or CLI)

Impact

• Cannot use Kiro CLI in headless/CI/CD mode (requires API key)
• No workaround available without creating a new IAM Identity Center instance in a different region

Environment

• Kiro IDE version: latest
• OS: macOS

Use Case

We use Kiro CLI in our CI/CD pipelines to run automated code reviews and generate code via headless mode (kiro-cli chat --no-interactive). This requires API key authentication (KIRO_API_KEY) since there is no browser available in CI/CD environments.

Our organization uses Microsoft Entra ID (Azure AD) as our identity provider, federated directly with Kiro via External IdP configuration. Our AWS IAM Identity Center is in ap-southeast-3 (Jakarta), which is not supported by the Kiro web portal for sign-in.

Without the ability to generate an API key, we cannot:

1. Integrate Kiro CLI into our GitHub Actions / CI/CD workflows
2. Run automated code generation or review tasks in non-interactive environments
3. Use headless mode for batch processing or scripting

We need either portal access for External IdP users or an alternative method to generate API keys (e.g., via AWS CLI, Kiro IDE, or admin-generated keys).

Additional Context

No response

[github-actions]

🤖 Potential Duplicate Detected

This issue appears to be similar to:

• #6255: Cannot login via CLI (85% similar)
• #6170: kiro-cli chat --no-interactive logs/errs Failed to get auth profile: missing field profile_name due to profile JSON casing mismatch (85% similar)
• #5810: Streamline re-authentication flow when login tokens expire for Enterprise IAM Identity Center customers. (85% similar)

What happens next?

• ⏰ This issue will be automatically closed in 3 days
• 🏷️ If this is not a duplicate, you can prevent automatic closure by adding a comment or reacting with 👎 to this message.
• 💬 Comment on the original issue if you have additional information

Why is this marked as duplicate?
Both issues report authentication/login problems with Kiro CLI, though the new issue is more specific about External IdP and API key generation while #6255 is about general CLI login failures

[github-actions]

Thank you for your feedback! 🙏

The 👎 reaction has been noted. The duplicate label has been removed and this issue has been sent back for maintainer review.

A maintainer will review this issue shortly.

[siriwatjiws]

I have the same issue (via kiro.dev only).
But I can login with EntraID directly in cli and IDE.
The problem is I cannot login to create API Key.

[AnilMaktala]

Thanks for the detailed context — headless CI/CD flows for organizations using External IdP (with IdC in regions the portal doesn't currently support) is a real gap, and we hear you on the alternatives (portal External IdP support, broader region coverage, or admin-generated API keys). Tracking this on the feature-request backlog; 👍 on the top post helps us gauge community demand. Please add a comment if your team has a similar constraint.

[itdsgroup]

Hi,
we have the same issue. We login using Azure IDP and are unable to generate API Keys.

thanks