Authentication

Kiro supports several authentication providers across all surfaces:

The providers work the same way everywhere, and sign-in completes in the browser:

• GitHub, Google, and AWS Builder ID — choose the provider, authenticate in your browser, and authorize the Kiro app (on GitHub, the app to authorize appears as kirodotdev).
• Your organization - If your Kiro account is managed by an admin, choose Your organization. You can use either AWS IAM Identity Center or an external Identity Provider such as Okta or Microsoft Entra ID:
  • AWS IAM Identity Center — you'll need the Start URL and the AWS Region that hosts your identity directory, provided by your admin.
  • External identity provider — enter your work email or the Kiro Start URL provided by your admin. This is also the path for AWS GovCloud (US) regions.

How you launch the flow differs per surface:

When a session you signed in to with AWS IAM Identity Center or AWS Builder ID expires, Kiro IDE shows Your Kiro session expired. Reconnect to followed by your Start URL or AWS Builder ID. Select Reconnect to sign in again with the same connection. You do not choose a sign-in method or re-enter the Start URL and AWS Region; you only complete the browser step.

• When the reconnect succeeds, the IDE shows Reconnected to Kiro.
• When it fails, the IDE shows We could not reconnect to Kiro. Please sign in again. with a Sign in button that starts a normal sign-in. If your administrator does not allow that sign-in method, the IDE shows your administrator's sign-in policy message in place of the generic text.
• If you dismiss the prompt or cancel in the browser, you stay signed out until you sign in again.

Kiro offers to reconnect only after an IAM Identity Center or AWS Builder ID sign-in. GitHub, Google, and external identity provider sign-ins do not get this prompt, and signing in with one of them clears any remembered IAM Identity Center or AWS Builder ID connection. Running Kiro: Sign Out also clears it, so no reconnect prompt appears after you sign out on purpose.

When running Kiro CLI on a remote machine (via SSH, SSM, containers, etc.), authentication works differently since the remote machine cannot open a browser.

Builder ID, IAM Identity Center, Google, and GitHub support device flow authentication in remote environments. The CLI displays a URL and a one-time code that you enter in any browser - no port forwarding required.

Your organization can turn off device flow sign-in for a Kiro profile. The CLI hides that profile during device flow login and profile switching. If no available profile remains, run kiro-cli login on a machine that can complete browser sign-in. Browser sign-in is not affected.

1. Run kiro-cli login and select your sign-in method (for example, Use with Builder ID, Use with Google, Use with GitHub, or Use with Your Organization).
2. The CLI displays a URL and a one-time code.
3. Open the URL in any browser (on your local machine, phone, or another device).
4. Enter the code and complete authentication.
5. The CLI detects the successful login automatically.

For CI/CD pipelines and automation scripts, you can authenticate using an API key instead of interactive sign-in.

1. Sign in to app.kiro.dev with your Kiro Pro, Pro+, Pro Max, or Power account.
2. Navigate to the API Keys section.
3. Create a new API key and copy it. The full key value is only shown at creation time. Set a meaningful name to remember the context of the key.

Set the KIRO_API_KEY environment variable and run Kiro CLI in non-interactive mode:

export KIRO_API_KEY=ksk_xxxxxxxx
kiro-cli chat --no-interactive "your prompt here"

On Windows:

$env:KIRO_API_KEY = "ksk_xxxxxxxx"
kiro-cli chat --no-interactive "your prompt here"

API key authentication supports all Kiro CLI features available in non-interactive mode. For interactive sessions, use browser-based sign-in instead. For CI/CD pipelines, automation scripts, and detailed headless usage, see Headless mode.

When multiple credentials are available, Kiro CLI uses this precedence order:

1. Active browser session (from kiro-cli login)
2. KIRO_API_KEY environment variable
3. No credentials - CLI prompts you to sign in

To check which authentication method is active, run kiro-cli whoami. Credits consumed using the API key are decremented from your subscription credits.

Connect your GitHub account to give the agent access to your repositories:

1. Go to Settings > Integrations.
2. Under GitHub, click Connect GitHub.
3. Authorize the Kiro Agent GitHub app.
4. Select which repositories the agent can access.

You must have write permissions on repositories for the agent to create branches and open pull requests.

How repository access works: Kiro Web shows all repositories where both conditions are met:

1. Your GitHub user has access to the repository.
2. The Kiro Agent GitHub app has been installed and authorized for that repository.

This means you see repositories from personal accounts, shared repositories, and organizations - as long as both your GitHub user and the Kiro Agent app have access.

See the GitHub integration guide for detailed setup instructions.

To use Kiro with AWS GovCloud (US):

• Ensure the Start URL used during authentication contains "us-gov-home", for example: https://start.us-gov-home.awsapps.com/directory/d-XXXXXXXXXX
• Kiro uses the same download/installer for both commercial and AWS GovCloud (US) regions. IAM Identity Center authentication automatically routes traffic to the appropriate AWS GovCloud (US) region.
• Kiro IDE version 0.9.2+ and Kiro CLI version 1.25.0+ are required for AWS GovCloud (US) regions support.
• Administrators can also connect a custom OIDC provider; users of such a profile are subscribed at first sign-in.

If you encounter problems during the authentication process, such as browser redirect failures or sign-in errors, check the troubleshooting guide for platform-specific solutions and common fixes.

• Set up your first project
• Explore privacy and data protection
• Configure enterprise identity providers