diff --git a/src/commands/debug.ts b/src/commands/debug.ts
index 7e9a8a7..c523d40 100644
--- a/src/commands/debug.ts
+++ b/src/commands/debug.ts
@@ -322,7 +322,6 @@ interface EnvVarInfo {
 
 const ENV_VAR_CATALOG: { name: string; effect: string }[] = [
   { name: 'WORKOS_API_KEY', effect: 'Bypasses credential resolution — used directly for API calls' },
-  { name: 'WORKOS_CLIENT_ID', effect: 'Overrides client ID from settings' },
   { name: 'WORKOS_FORCE_TTY', effect: 'Forces human (non-JSON) output mode, even when piped' },
   { name: 'WORKOS_NO_PROMPT', effect: 'Forces non-interactive/JSON mode' },
   { name: 'WORKOS_TELEMETRY', effect: 'Set to "false" to disable telemetry' },
diff --git a/src/commands/login.ts b/src/commands/login.ts
index e1d0efa..0fa7a60 100644
--- a/src/commands/login.ts
+++ b/src/commands/login.ts
@@ -106,11 +106,6 @@ export async function provisionStagingEnvironment(accessToken: string): Promise<
 export async function runLogin(): Promise<void> {
   const clientId = getCliAuthClientId();
 
-  if (!clientId) {
-    clack.log.error('CLI auth not configured. Set WORKOS_CLI_CLIENT_ID environment variable.');
-    process.exit(1);
-  }
-
   // Check if already logged in with valid token
   if (getAccessToken()) {
     const creds = getCredentials();
diff --git a/src/lib/run-with-core.ts b/src/lib/run-with-core.ts
index e79b7d7..79c106e 100644
--- a/src/lib/run-with-core.ts
+++ b/src/lib/run-with-core.ts
@@ -329,10 +329,6 @@ export async function runWithCore(options: InstallerOptions): Promise<void> {
         const clientId = getCliAuthClientId();
         const authkitDomain = getAuthkitDomain();
 
-        if (!clientId) {
-          throw new Error('CLI auth not configured. Set WORKOS_CLI_CLIENT_ID environment variable.');
-        }
-
         const deviceAuth = await requestDeviceCode({
           clientId,
           authkitDomain,
diff --git a/src/lib/settings.ts b/src/lib/settings.ts
index b8a320c..285eec8 100644
--- a/src/lib/settings.ts
+++ b/src/lib/settings.ts
@@ -60,7 +60,7 @@ export function getConfig(): InstallerConfig {
  * Env var overrides config default.
  */
 export function getCliAuthClientId(): string {
-  return process.env.WORKOS_CLIENT_ID || config.workos.clientId;
+  return config.workos.clientId;
 }
 
 /**