diff --git a/cmd/go-aws-sso/main.go b/cmd/go-aws-sso/main.go
index 6bc8a61..e63fd24 100644
--- a/cmd/go-aws-sso/main.go
+++ b/cmd/go-aws-sso/main.go
@@ -63,6 +63,13 @@ func main() {
 			Hidden:   false,
 			Required: false,
 		},
+		&cli.BoolFlag{
+			Name:     "headless",
+			Usage:    "show the verification URL without opening it in a browser",
+			Value:    false,
+			Hidden:   false,
+			Required: false,
+		},
 	}
 
 	initialFlags = append(configFlags, initialFlags...)
diff --git a/pkg/sso/aws.go b/pkg/sso/aws.go
index 7c5eb24..9a90503 100644
--- a/pkg/sso/aws.go
+++ b/pkg/sso/aws.go
@@ -170,7 +170,12 @@ func startDeviceAuthorization(oidc ssooidciface.SSOOIDCAPI, rco *ssooidc.Registe
 	sdao, err := oidc.StartDeviceAuthorization(&ssooidc.StartDeviceAuthorizationInput{ClientId: rco.ClientId, ClientSecret: rco.ClientSecret, StartUrl: &startUrl})
 	check(err)
 	zap.S().Warnf("Please verify your client request: %s", *sdao.VerificationUriComplete)
-	openUrlInBrowser(*sdao.VerificationUriComplete)
+
+	//  open it in a browser unless in headless mode
+	if !strings.Contains(strings.Join(os.Args, ","), "--headless") {
+		openUrlInBrowser(*sdao.VerificationUriComplete)
+	}
+
 	return *sdao
 }