diff --git a/src/pages/get-started/cli.mdx b/src/pages/get-started/cli.mdx
index e0e28cbc..136df8d9 100644
--- a/src/pages/get-started/cli.mdx
+++ b/src/pages/get-started/cli.mdx
@@ -119,6 +119,7 @@ The command will check if the peer is logged in and connect to the management se
       --profile string                      Profile name to use for the login. If not specified, the last used profile will be used.
       --rosenpass-permissive                [Experimental] Enable Rosenpass in permissive mode to allow this peer to accept WireGuard connections without requiring Rosenpass functionality from peers that do not have Rosenpass enabled.
       --ssh-jwt-cache-ttl int               SSH JWT token cache TTL in seconds (default 0, disabled). When enabled, the client caches the JWT so repeated SSH connections skip the OIDC login flow. The receiving SSH server rejects tokens older than 10 minutes, so values above 600 will result in authentication failures for cached tokens.
+      --use-device-auth                     force the OAuth 2.0 Device Authorization Grant instead of the PKCE/browser flow
       --wireguard-port uint16               WireGuard interface listening port (default 51820)
 ```
 #### Usage
@@ -153,8 +154,9 @@ netbird up --setup-key AAAA-BBB-CCC-DDDDDD --extra-dns-labels vpc1,mgmt1
 Command to authenticate the NetBird client to a management service. If the peer is not logged in, by default, it will attempt to initiate an SSO login flow.
 #### Flags
 ```shell
-      --no-browser       Do not open the browser for SSO login
-      --profile string   Profile name to use for the login. If not specified, the last used profile will be used.
+      --no-browser         Do not open the browser for SSO login
+      --profile string     Profile name to use for the login. If not specified, the last used profile will be used.
+      --use-device-auth    force the OAuth 2.0 Device Authorization Grant instead of the PKCE/browser flow
 ```
 #### Usage
 The minimal form of running the command is: