kiro) is Amazon’s agentic coding CLI. Unlike the others, it has
no static API key — it authenticates with an OAuth device flow, and
AgentBees remembers the login so you only do it once.
How the login works
Because a workspace pod can’t open a browser, Kiro uses a device-flow login: the first Kiro task prints a short URL and code to its console. You approve it once in your browser, and AgentBees captures the resulting login and reuses it for every later Kiro task — no per-task prompt.1
Choose a license in Admin → Agent LLM
- Free (Builder ID) — no Start URL needed. - Pro (Identity Center) — requires your AWS
Start URL (e.g.
https://my-org.awsapps.com/start) and Region. Save is disabled until the Start URL is set.
2
Run your first Kiro task
Its console shows a device-login URL + code. Approve it in your browser.
3
Done — it's remembered
Every subsequent Kiro task reuses the captured login. Admin shows ”✓ Logged in once — Kiro tasks
reuse this login (no per-task prompt).”
Resetting the login
If you need to log in fresh (e.g. switching accounts), use Reset login in Admin → Agent LLM. The next Kiro task will prompt for device login again.No API key is ever stored for Kiro. The captured login is held securely and used only to skip the
interactive prompt on later tasks.