> "This can be avoided by having the process listen on localhost, and then have the login flow redirect to localhost (including the token) on successful complet

> "This can be avoided by having the process listen on localhost, and then have the login flow redirect to localhost (including the token) on successful completion." I think this is what the AWS Client VPN client for Ubuntu does. So AWS does have the method in their tool set somewhere, though I imagine it's owned by an entirely different team than their CLI.