- **CLI Authentication**: Replaced password prompt with OAuth 2.0 + PKCE browser flow
  - `aim-sdk login` now opens browser for secure authentication (Google, etc.)
  - Uses PKCE (Proof Key for Code Exchange) per RFC 8252 - same as AWS CLI
  - No more password prompts or browser permission dialogs
  - Browser redirects directly to localhost - seamless experience

- PKCE prevents authorization code interception attacks
- State parameter prevents CSRF attacks
- Authorization codes are one-time use with 5-minute TTL

```bash
pip install --upgrade aim-sdk
aim-sdk login
```