diff --git a/docs/cli/commands/login.mdx b/docs/cli/commands/login.mdx
index 721f905dd..b7614d68d 100644
--- a/docs/cli/commands/login.mdx
+++ b/docs/cli/commands/login.mdx
@@ -22,107 +22,6 @@ If you have added multiple users, you can switch between the users by using the
-### Flags
-
-The login command supports a number of flags that you can use for different authentication methods. Below is a list of all the flags that can be used with the login command.
-
-
-
- ```bash
- infisical login --method= # Optional, will default to 'user'.
- ```
-
- #### Valid values for the `method` flag are:
- - `user`: Login using email and password. (default)
- - `universal-auth`: Login using a universal auth client ID and client secret.
- - `kubernetes`: Login using a Kubernetes native auth.
- - `azure`: Login using an Azure native auth.
- - `gcp-id-token`: Login using a GCP ID token native auth.
- - `gcp-iam`: Login using a GCP IAM.
- - `aws-iam`: Login using an AWS IAM native auth.
-
-
-
- ```bash
- infisical login --client-id= # Optional, required if --method=universal-auth.
- ```
-
- #### Description
- The client ID of the universal auth machine identity. This is required if the `--method` flag is set to `universal-auth`.
-
-
- The `client-id` flag can be substituted with the `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` environment variable.
-
-
-
-
- ```bash
- infisical login --client-secret= # Optional, required if --method=universal-auth.
- ```
- #### Description
- The client secret of the universal auth machine identity. This is required if the `--method` flag is set to `universal-auth`.
-
-
- The `client-secret` flag can be substituted with the `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` environment variable.
-
-
-
-
- ```bash
- infisical login --machine-identity-id= # Optional, required if --method=kubernetes, azure, gcp-id-token, gcp-iam, or aws-iam.
- ```
-
- #### Description
- The ID of the machine identity. This is required if the `--method` flag is set to `kubernetes`, `azure`, `gcp-id-token`, `gcp-iam`, or `aws-iam`.
-
-
- The `machine-identity-id` flag can be substituted with the `INFISICAL_MACHINE_IDENTITY_ID` environment variable.
-
-
-
-
- ```bash
- infisical login --service-account-token-path= # Optional Will default to '/var/run/secrets/kubernetes.io/serviceaccount/token'.
- ```
-
- #### Description
- The path to the Kubernetes service account token to use for authentication.
- This is optional and will default to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
-
-
- The `service-account-token-path` flag can be substituted with the `INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH` environment variable.
-
-
-
-
- ```bash
- infisical login --service-account-key-file-path= # Optional, but required if --method=gcp-iam.
- ```
-
- #### Description
- The path to your GCP service account key file. This is required if the `--method` flag is set to `gcp-iam`.
-
-
- The `service-account-key-path` flag can be substituted with the `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` environment variable.
-
-
-
-
-
-
- ```bash
- infisical login --oidc-jwt=
- ```
-
- #### Description
- The JWT provided by an identity provider for OIDC authentication.
-
-
- The `oidc-jwt` flag can be substituted with the `INFISICAL_OIDC_AUTH_JWT` environment variable.
-
-
-
-
### Authentication Methods
The Infisical CLI supports multiple authentication methods. Below are the available authentication methods, with their respective flags.
@@ -321,6 +220,109 @@ The Infisical CLI supports multiple authentication methods. Below are the availa
+### Flags
+
+The login command supports a number of flags that you can use for different authentication methods. Below is a list of all the flags that can be used with the login command.
+
+
+
+ ```bash
+ infisical login --method= # Optional, will default to 'user'.
+ ```
+
+ #### Valid values for the `method` flag are:
+ - `user`: Login using email and password. (default)
+ - `universal-auth`: Login using a universal auth client ID and client secret.
+ - `kubernetes`: Login using a Kubernetes native auth.
+ - `azure`: Login using an Azure native auth.
+ - `gcp-id-token`: Login using a GCP ID token native auth.
+ - `gcp-iam`: Login using a GCP IAM.
+ - `aws-iam`: Login using an AWS IAM native auth.
+ - `oidc-auth`: Login using oidc auth.
+
+
+
+ ```bash
+ infisical login --client-id= # Optional, required if --method=universal-auth.
+ ```
+
+ #### Description
+ The client ID of the universal auth machine identity. This is required if the `--method` flag is set to `universal-auth`.
+
+
+ The `client-id` flag can be substituted with the `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` environment variable.
+
+
+
+
+ ```bash
+ infisical login --client-secret= # Optional, required if --method=universal-auth.
+ ```
+ #### Description
+ The client secret of the universal auth machine identity. This is required if the `--method` flag is set to `universal-auth`.
+
+
+ The `client-secret` flag can be substituted with the `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` environment variable.
+
+
+
+
+ ```bash
+ infisical login --machine-identity-id= # Optional, required if --method=kubernetes, azure, gcp-id-token, gcp-iam, or aws-iam.
+ ```
+
+ #### Description
+ The ID of the machine identity. This is required if the `--method` flag is set to `kubernetes`, `azure`, `gcp-id-token`, `gcp-iam`, or `aws-iam`.
+
+
+ The `machine-identity-id` flag can be substituted with the `INFISICAL_MACHINE_IDENTITY_ID` environment variable.
+
+
+
+
+ ```bash
+ infisical login --service-account-token-path= # Optional Will default to '/var/run/secrets/kubernetes.io/serviceaccount/token'.
+ ```
+
+ #### Description
+ The path to the Kubernetes service account token to use for authentication.
+ This is optional and will default to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
+
+
+ The `service-account-token-path` flag can be substituted with the `INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH` environment variable.
+
+
+
+
+ ```bash
+ infisical login --service-account-key-file-path= # Optional, but required if --method=gcp-iam.
+ ```
+
+ #### Description
+ The path to your GCP service account key file. This is required if the `--method` flag is set to `gcp-iam`.
+
+
+ The `service-account-key-path` flag can be substituted with the `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` environment variable.
+
+
+
+
+
+
+ ```bash
+ infisical login --oidc-jwt=
+ ```
+
+ #### Description
+ The JWT provided by an identity provider for OIDC authentication.
+
+
+ The `oidc-jwt` flag can be substituted with the `INFISICAL_OIDC_AUTH_JWT` environment variable.
+
+
+
+
+
### Machine Identity Authentication Quick Start
In this example we'll be using the `universal-auth` method to login to obtain an Infisical access token, which we will then use to fetch secrets with.