diff --git a/src/commands/auth/auth-login.ts b/src/commands/auth/auth-login.ts
index 81714104..b3fb1cca 100644
--- a/src/commands/auth/auth-login.ts
+++ b/src/commands/auth/auth-login.ts
@@ -34,13 +34,13 @@ export const loginCommand = new Command()
   .option("-k, --key <key:string>", "API key (prompted if not provided)")
   .action(async (options) => {
     try {
-      let apiKey = options.key
+      let apiKey = options.key?.trim()
 
       if (!apiKey) {
-        apiKey = await Secret.prompt({
+        apiKey = (await Secret.prompt({
           message: "Enter your Linear API key",
           hint: "Create one at https://linear.app/settings/account/security",
-        })
+        }))?.trim()
       }
 
       if (!apiKey) {
@@ -50,6 +50,9 @@ export const loginCommand = new Command()
         })
       }
 
+      // Strip stray characters that some terminals (e.g. Windows) inject around pasted text
+      apiKey = apiKey.replace(/^[^a-zA-Z0-9_]+|[^a-zA-Z0-9_]+$/g, "")
+
       // Validate the API key by querying the API
       const client = createGraphQLClient(apiKey)