Device authorization#

Command-line tools sign in through /device. The tool shows a short code such as ABCD-EFGH and opens this page, usually with the code already filled in.

Approving a device#

You must be signed in; otherwise the page offers Sign in and returns you to the same code afterwards. With the code in place, Continue shows the permissions the tool is asking for and when the request expires. Approve binds the request to your account; the tool then receives a token that lasts 90 days and carries the requested permissions plus any optional permissions you select on the consent page. Deny refuses it. Either way the page tells you to return to your terminal.

Codes are eight characters, case-insensitive, with or without the dash. A code that is mistyped, already used or expired is refused; start again from the tool.

Previewing or approving needs a recent confirmation of your identity on this session (a fresh sign-in counts). If it has expired, Confirm it's you offers your passkey or password and then resumes the interrupted step. Confirming a preview does not approve the device: review its permissions and choose Approve separately. You can dismiss the prompt and use Continue to retry the same code. An expired device code remains an inline error; request a new code from the tool.

Public profile consent#

Also allow editing my public profile and pinned repositories is an optional, off-by-default permission. Enable it for the profile management commands; existing logins do not acquire it automatically. It does not grant account, password or email management.

CLI credential management#

To let the CLI manage your tokens and SSH/GPG keys, select Also allow managing my tokens and SSH/GPG keys before approving the login. This permission is off by default. Existing logins do not gain it automatically; sign in again to change your consent.

Only enable this for tools you trust to manage your credentials. Tokens and keys created by the tool can remain active after its own login expires or is revoked. Restricted or delegated credentials cannot use this permission to create independent credentials.

Without it, the CLI can list your public keys and inspect or revoke its own token, but cannot manage all of your credentials. A forbidden response explains when management permission is missing.

The CLI cannot rotate the token it is currently using. Run cafe auth login to create a fresh login, then revoke the old token from Settings → Tokens or with a different management credential. Other tokens can be rotated normally.