diff --git a/planet/cli/auth.py b/planet/cli/auth.py
index a789ec7a..77386e63 100644
--- a/planet/cli/auth.py
+++ b/planet/cli/auth.py
@@ -16,15 +16,56 @@
 import click
 import planet_auth_utils
 
+import planet
+
 LOGGER = logging.getLogger(__name__)
 
 
+def prime_cli_auth_ctx(ctx,
+                       auth_profile,
+                       auth_client_id,
+                       auth_client_secret,
+                       auth_api_key):
+    # Delay creating the auth context until we need it.
+    # See below.
+    ctx.obj['PLAUTH_FACTORY_INIT_ARGS'] = {
+        'auth_profile_opt': auth_profile,
+        'auth_client_id_opt': auth_client_id,
+        'auth_client_secret_opt': auth_client_secret,
+        'auth_api_key_opt': auth_api_key,
+        'use_env': True,
+        'use_configfile': True,
+    }
+    return
+
+
+def init_cli_auth_ctx_jit(ctx):
+    """
+    init the planet-auth state stored in the click CLI JIT.
+    Setting this up and pulling the trigger are separated to offer a more ergonomic
+    experience for warnings, suppressing them if they would be irrelevant.
+    """
+    # planet-auth library Auth context type
+    # Embedded click commands imported from planet_auth_utils expect
+    # this in the 'AUTH' context field.
+    if ctx.obj['PLAUTH_FACTORY_INIT_ARGS']:
+        ctx.obj['AUTH'] = (
+            planet_auth_utils.PlanetAuthFactory.initialize_auth_client_context(
+                **ctx.obj['PLAUTH_FACTORY_INIT_ARGS'])
+        )
+
+    # planet SDK Auth context type
+    ctx.obj['PLSDK_AUTH'] = planet.Auth._from_plauth(
+        pl_authlib_context=ctx.obj['AUTH'])
+
+
 @click.group("auth")  # type: ignore
 @click.pass_context
 def cmd_auth(ctx):
     """
     Commands for working with Planet authentication.
     """
+    init_cli_auth_ctx_jit(ctx)
 
 
 cmd_auth.add_command(name="login", cmd=planet_auth_utils.cmd_plauth_login)
diff --git a/planet/cli/cli.py b/planet/cli/cli.py
index 2b63cd03..4edc72ee 100644
--- a/planet/cli/cli.py
+++ b/planet/cli/cli.py
@@ -57,33 +57,11 @@ def main(ctx,
     ctx.ensure_object(dict)
     ctx.obj['QUIET'] = quiet
 
-    _configure_cli_auth_ctx(ctx,
-                            auth_profile,
-                            auth_client_id,
-                            auth_client_secret,
-                            auth_api_key)
-
-
-def _configure_cli_auth_ctx(ctx,
-                            auth_profile,
-                            auth_client_id,
-                            auth_client_secret,
-                            auth_api_key):
-    # planet-auth library Auth context type
-    # Embedded click commands imported from planet_auth_utils expect
-    # this in the 'AUTH' context field.
-    ctx.obj[
-        'AUTH'] = planet_auth_utils.PlanetAuthFactory.initialize_auth_client_context(
-            auth_profile_opt=auth_profile,
-            auth_client_id_opt=auth_client_id,
-            auth_client_secret_opt=auth_client_secret,
-            auth_api_key_opt=auth_api_key,
-            use_env=True,
-            use_configfile=True)
-
-    # planet SDK Auth context type
-    ctx.obj['PLSDK_AUTH'] = planet.Auth._from_plauth(
-        pl_authlib_context=ctx.obj['AUTH'])
+    auth.prime_cli_auth_ctx(ctx,
+                       auth_profile,
+                       auth_client_id,
+                       auth_client_secret,
+                       auth_api_key)
 
 
 def _configure_logging(verbosity):
diff --git a/planet/cli/session.py b/planet/cli/session.py
index 8c1d3f6f..c594fc5f 100644
--- a/planet/cli/session.py
+++ b/planet/cli/session.py
@@ -1,19 +1,20 @@
 """CLI HTTP/auth sessions."""
 
 from planet.http import Session
-
+from planet.cli.auth import init_cli_auth_ctx_jit
 
 class CliSession(Session):
     """Session with CLI-specific auth and identifying header"""
 
     def __init__(self, click_ctx=None, plsdk_auth=None):
-        if click_ctx:
-            _plsdk_auth = click_ctx.obj['PLSDK_AUTH']
-        else:
-            _plsdk_auth = None
-
         if plsdk_auth:
             _plsdk_auth = plsdk_auth
+        else:
+            if click_ctx:
+                init_cli_auth_ctx_jit(click_ctx)
+                _pksdk_auth = click_ctx.obj['PLSDK_AUTH']
+            else:
+                _plsdk_auth = None
 
         super().__init__(_plsdk_auth)
         self._client.headers.update({'X-Planet-App': 'python-cli'})