diff --git a/.changeset/petite-cities-lose.md b/.changeset/petite-cities-lose.md
new file mode 100644
index 00000000..fd1dbe17
--- /dev/null
+++ b/.changeset/petite-cities-lose.md
@@ -0,0 +1,5 @@
+---
+"@cipherstash/cli": minor
+---
+
+Fix invalid client error.
diff --git a/packages/cli/src/commands/auth/login.ts b/packages/cli/src/commands/auth/login.ts
index a44f933c..9aa7229b 100644
--- a/packages/cli/src/commands/auth/login.ts
+++ b/packages/cli/src/commands/auth/login.ts
@@ -27,13 +27,12 @@ export async function selectRegion(): Promise<string> {
   return region
 }
 
-export async function login(region: string, referrer: string | undefined) {
+export async function login(region: string, _referrer: string | undefined) {
   const s = p.spinner()
 
-  const pending = await beginDeviceCodeFlow(
-    region,
-    `cli-${referrer ?? 'cipherstash'}`,
-  )
+  // Must be 'cli' — it's the only OAuth client_id registered with CTS.
+  // Passing anything else (e.g. `cli-supabase`) causes INVALID_CLIENT.
+  const pending = await beginDeviceCodeFlow(region, 'cli')
 
   p.log.info(`Your code is: ${pending.userCode}`)
   p.log.info(`Visit: ${pending.verificationUriComplete}`)