@@ -12,8 +12,8 @@ use tokio::sync::{mpsc, oneshot, watch};
 use agentdesktop_core::{
     config::{DaemonConfig, LlmGatewayAuthentication, ProgramAuthentication, valid_client_id},
     model::{
-        DaemonInfo, Discovery, EnrollmentStatus, Health, LlmGatewayCredential, TelemetryEvent,
-        TelemetryEventKind,
+        DaemonInfo, Discovery, EnrollmentStatus, Health, LlmGatewayCredential,
+        LlmGatewayLoginStatus, TelemetryEvent, TelemetryEventKind,
     },
 };
 
@@ -49,6 +49,7 @@ pub fn router(state: AppState) -> Router {
         .route("/v1/logout", post(logout))
         .route("/v1/telemetry", post(telemetry))
         .route("/v1/llm-gateway/credential", get(llm_gateway_credential))
+        .route("/v1/llm-gateway/login", post(llm_gateway_login))
         .with_state(state)
 }
 
@@ -273,6 +274,7 @@ pub(crate) async fn gateway_credential(
             redirect_uri,
             scopes,
             allow_insecure,
+            device_authorization,
         }) => gateway_oidc::credential(
             issuer,
             client_id,
@@ -297,6 +299,7 @@ pub(crate) async fn gateway_credential(
                         .flatten()
                     })
                 },
+                device_authorization: *device_authorization,
             },
         )
         .await
@@ -310,7 +313,14 @@ pub(crate) async fn gateway_credential(
             "LLM gateway has no authentication configured"
         )),
     }
-    .map_err(|error| (StatusCode::BAD_GATEWAY, format!("{error:#}")))?;
+    .map_err(|error| {
+        let status = if error.is::<gateway_oidc::SignInRequired>() {
+            StatusCode::UNAUTHORIZED
+        } else {
+            StatusCode::BAD_GATEWAY
+        };
+        (status, format!("{error:#}"))
+    })?;
     if uses_subscription {
         subscription::compose(
             identity,
@@ -325,6 +335,38 @@ pub(crate) async fn gateway_credential(
     .map_err(|error| (StatusCode::BAD_GATEWAY, format!("{error:#}")))
 }
 
+async fn llm_gateway_login(
+    State(state): State<AppState>,
+) -> Result<Json<LlmGatewayLoginStatus>, (StatusCode, String)> {
+    let effective = load_effective_config(&state.config, &state.state_dir).map_err(|error| {
+        (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            format!("read applied configuration: {error:#}"),
+        )
+    })?;
+    let Some(LlmGatewayAuthentication::Oidc {
+        issuer,
+        client_id,
+        scopes,
+        allow_insecure,
+        device_authorization: true,
+        ..
+    }) = effective
+        .llm_gateway
+        .as_ref()
+        .and_then(|gateway| gateway.authentication.as_ref())
+    else {
+        return Err((
+            StatusCode::FAILED_DEPENDENCY,
+            "LLM gateway sign-in with device authorization is not configured".to_owned(),
+        ));
+    };
+    gateway_oidc::device_login(issuer, client_id, scopes, *allow_insecure, &state.state_dir)
+        .await
+        .map(Json)
+        .map_err(|error| (StatusCode::BAD_GATEWAY, format!("{error:#}")))
+}
+
 fn program_uses_subscription(config: &DaemonConfig, client_id: &str) -> bool {
     match client_id {
         "claude-code" => config
 
@@ -3,7 +3,10 @@ use std::{io::Read, path::PathBuf};
 use agentdesktop_client as client;
 use agentdesktop_core::{
     config::DaemonConfig,
-    model::{Discovery, EnrollmentStatus, Health, LlmGatewayCredential, TelemetryEventKind},
+    model::{
+        Discovery, EnrollmentStatus, Health, LlmGatewayCredential, LlmGatewayLoginStatus,
+        TelemetryEventKind,
+    },
 };
 use clap::Subcommand;
 use serde::Deserialize;
@@ -26,6 +29,9 @@ pub enum ClientCommand {
         #[arg(long, default_value = "agentdesktop")]
         client_id: String,
     },
+    /// Sign in to the LLM gateway with OIDC device authorization and print
+    /// the verification URL and code to approve from any device.
+    Login,
     /// Handle an event emitted by a managed developer-tool hook.
     Hook {
         #[command(subcommand)]
@@ -75,6 +81,17 @@ pub async fn run(command: ClientCommand, socket: PathBuf) -> anyhow::Result<()>
                 println!("Code: {code}");
             }
         }
+        ClientCommand::Login => {
+            let login: LlmGatewayLoginStatus =
+                client::post(&socket, "/v1/llm-gateway/login").await?;
+            println!("{}", login.status);
+            if let Some(url) = login.verification_url {
+                println!("Sign in at: {url}");
+            }
+            if let Some(code) = login.user_code {
+                println!("Code: {code}");
+            }
+        }
         ClientCommand::Discover => {
             let discovery: Discovery = client::get(&socket, "/v1/discovery").await?;
             if discovery.agents.is_empty() && discovery.model_runtimes.is_empty() {
 
@@ -436,6 +436,12 @@ where
         reconciler
             .apply(&initial_config)
             .context("apply initial daemon configuration")?;
+        // With a controller, the cached controller configuration is what is in effect
+        // from here, and start_gateway_authentication above only saw the local file.
+        // Without one the two are the same configuration and it already ran.
+        if config.controller.is_some() {
+            gateway_oidc::start_device_login_if_configured(&initial_config, &args.state_dir);
+        }
     } else {
         tracing::info!(
             "preserving managed files until the controller provides daemon configuration"
@@ -755,8 +761,23 @@ fn start_gateway_authentication(
                 redirect_uri,
                 scopes,
                 allow_insecure,
+                device_authorization,
             }) = authentication
             {
+                if device_authorization {
+                    // Logs the verification URL and code, then signs in in the
+                    // background once the user approves from any device.
+                    tracing::info!(%issuer, "starting LLM gateway OIDC device authorization");
+                    gateway_oidc::device_login(
+                        &issuer,
+                        &client_id,
+                        &scopes,
+                        allow_insecure,
+                        &state_dir,
+                    )
+                    .await?;
+                    return Ok(());
+                }
                 tracing::info!(%issuer, "starting LLM gateway OIDC authentication");
                 let acquired = gateway_oidc::credential(
                     &issuer,
@@ -777,6 +798,7 @@ fn start_gateway_authentication(
                                 .then(|| github.client_id.clone())
                                 .flatten()
                         }),
+                        device_authorization: false,
                     },
                 )
                 .await?;