# Device authorization

Command-line tools sign in through `/device`. The tool shows a short code such
as `ABCD-EFGH` and opens this page, usually with the code already filled in.

## Approving a device

You must be signed in; otherwise the page offers **Sign in** and returns you to
the same code afterwards. With the code in place, **Continue** shows the
permissions the tool is asking for and when the request expires. **Approve**
binds the request to your account; the tool then receives a token that lasts
90 days and carries the requested permissions plus any optional permissions
you select on the consent page. **Deny** refuses it. Either way
the page tells you to return to your terminal.

Codes are eight characters, case-insensitive, with or without the dash. A code
that is mistyped, already used or expired is refused; start again from the
tool.

Previewing or approving needs a recent confirmation of your identity on this
session (a fresh sign-in counts). If it has expired, **Confirm it's you** offers
your passkey or password and then resumes the interrupted step. Confirming a
preview does not approve the device: review its permissions and choose
**Approve** separately. You can dismiss the prompt and use **Continue** to retry
the same code. An expired device code remains an inline error; request a new
code from the tool.

## Public profile consent

**Also allow editing my public profile and pinned repositories** is an optional,
off-by-default permission. Enable it for the [profile management commands](https://git.cafe/docs/account/profile-management.md);
existing logins do not acquire it automatically. It does not grant account,
password or email management.

## CLI credential management

To let the CLI manage your tokens and SSH/GPG keys, select **Also allow managing
my tokens and SSH/GPG keys** before approving the login. This permission is off
by default. Existing logins do not gain it automatically; sign in again to change
your consent.

Only enable this for tools you trust to manage your credentials. Tokens and
keys created by the tool can remain active after its own login expires or is
revoked. Restricted or delegated credentials cannot use this permission to
create independent credentials.

Without it, the CLI can list your public keys and inspect or revoke its own
token, but cannot manage all of your credentials. A forbidden response explains
when management permission is missing.

The CLI cannot rotate the token it is currently using. Run `cafe auth login` to
create a fresh login, then revoke the old token from **Settings → Tokens** or
with a different management credential. Other tokens can be rotated normally.