sf login
Login state is written to
~/.forge/ (permissions 0600). The browser flow uses OAuth + PKCE; when the platform is configured with OIDC (e.g. Casdoor), it automatically redirects to single sign-on.
Console login. The same page is used when sf login opens a browser.