diff --git a/.changeset/fix-cli-login.md b/.changeset/fix-cli-login.md
new file mode 100644
index 00000000..ec42af06
--- /dev/null
+++ b/.changeset/fix-cli-login.md
@@ -0,0 +1,5 @@
+---
+"emdash": patch
+---
+
+Fix CLI login against remote Cloudflare-deployed instances by unwrapping API response envelope and adding admin scope
diff --git a/packages/core/src/cli/commands/login.ts b/packages/core/src/cli/commands/login.ts
index 06d4b8dc..8b289a68 100644
--- a/packages/core/src/cli/commands/login.ts
+++ b/packages/core/src/cli/commands/login.ts
@@ -92,7 +92,8 @@ async function pollForToken(
 		});
 
 		if (res.ok) {
-			return (await res.json()) as TokenResponse;
+			const body = (await res.json()) as { data: TokenResponse };
+			return body.data;
 		}
 
 		const body = (await res.json()) as { error?: string; interval?: number };
@@ -269,6 +270,7 @@ export const loginCommand = defineCommand({
 				},
 				body: JSON.stringify({
 					client_id: "emdash-cli",
+					scope: "admin",
 				}),
 			});
 
@@ -277,7 +279,8 @@ export const loginCommand = defineCommand({
 				process.exit(2);
 			}
 
-			const deviceCode = (await codeRes.json()) as DeviceCodeResponse;
+			const deviceCodeBody = (await codeRes.json()) as { data: DeviceCodeResponse };
+			const deviceCode = deviceCodeBody.data;
 
 			// Step 3: Display instructions
 			console.log();