Device sign-in

1. The CLI prints a URL and a code like BCDF-GHJK, and opens the browser (--no-browser to only print it).
2. On /device you sign in if you aren’t already (the same WorkOS sign-in as the web app), then see the code, the app, the device name and a coarse network hint. Only approve if your terminal shows this exact code.
3. Pick your workspace, then Approve. Any member can approve: the key is yours and can only check actions and read maps.
4. The CLI receives an agent key for that workspace and saves it in ~/.config/getclaros/config.json (mode 0600). It never prints it.

​

The protocol

curl -X POST $CLAROS_URL/v1/device \
  -H "content-type: application/json" -d '{"client_name": "my-tool", "device_name": "build-01"}'
# → device_code, user_code, verification_uri, verification_uri_complete, expires_in: 600, interval: 5

curl -X POST $CLAROS_URL/v1/device/token \
  -d grant_type=urn:ietf:params:oauth:grant-type:device_code -d device_code=...

{ "access_token": "clr_…", "token_type": "Bearer", "scope": "agent", "workspace": { "id": "ws_…", "name": "Support" } }