Sign in with device authorization
Your tools sign in as you with OAuth 2.0 device authorization (RFC 8628). The tool shows a code; you approve it in the Console, where you are already signed in, and choose the workspace its usage belongs to. The tool never sees your password and never needs an API key.
Note
Sign-in is decided and not yet served; hi and HIPS Code use it once they are published.
Step 1: Run
hi login. It prints a user codeXXXX-XXXX, a QR code drawn in the terminal and the link that both encode.Step 2: Open the link, or scan the QR code with a phone: the approval page needs no browser on the same machine.
Step 3: In the Console, check the tool's name, the access it asks for and where the request came from, choose the workspace, and approve.
Step 4:
histops waiting and says which workspace it is signed in to.
Shell
hi login- Eight characters from an alphabet with no look-alike characters, shown as
XXXX-XXXX. - Single use, and valid for 10 minutes.
- Void after five wrong attempts, and rate-limited per address and per account.
- Approve only a code you started yourself. If a code reaches you any other way, deny it.
The approval page at console.hips.com/device shows the tool's name, the access it asks for in plain words, the address and country the request came from, and the workspace choice with that workspace's tool defaults. Approve or deny; nothing happens until you do.
| The Console answers | What it means |
|---|---|
tool_defaults_required | The workspace has no tool defaults yet: an owner or admin sets the pool, pricing mode, region and fallback used for tools in Workspace settings, then you approve again |
verification_required | The workspace owner has not passed identity verification |
| Not found | The code is unknown, expired, used or voided. One message for all four, so a guess learns nothing |
- The Console answers
tool_defaults_required- What it means
- The workspace has no tool defaults yet: an owner or admin sets the pool, pricing mode, region and fallback used for tools in Workspace settings, then you approve again
- The Console answers
verification_required- What it means
- The workspace owner has not passed identity verification
- The Console answers
- Not found
- What it means
- The code is unknown, expired, used or voided. One message for all four, so a guess learns nothing
The client `hi` asks for two of the four scopes; `provider` is the provider app's and `admin` is never asked for by a buyer's tool
| Scope | Allows |
|---|---|
inference | Requests in the workspace you chose, attributed to you |
account | Reading who is signed in |
- Scope
inference- Allows
- Requests in the workspace you chose, attributed to you
- Scope
account- Allows
- Reading who is signed in
- An access token that lasts 1 hour, and a refresh token that lasts 30 days and is replaced each time it is used.
- Both kept in the operating system's keystore and refreshed by the tool without asking. Never printed.
- At the gateway the access token works like a key of the workspace you chose, with the same rate limits, and the workspace's tool defaults in place of a key's defaults.
Three exact paths on ai.hips.com, in OAuth's own wire format. A tool calls them; you never do.
/auth/device/codepreviewStart a sign-in: the device code, the user code XXXX-XXXX and the links.
/auth/device/tokenpreviewPoll with the device code until approved; later, exchange the refresh token for a new access token.
/auth/device/revokepreviewRevoke the sign-in (RFC 7009); hi logout calls it.
| While polling | What hi does |
|---|---|
authorization_pending | Keeps waiting |
slow_down | Waits longer between polls |
access_denied | Stops: the code was denied in the Console |
expired_token | Stops: the code expired; run hi login again |
- While polling
authorization_pending- What hi does
- Keeps waiting
- While polling
slow_down- What hi does
- Waits longer between polls
- While polling
access_denied- What hi does
- Stops: the code was denied in the Console
- While polling
expired_token- What hi does
- Stops: the code expired; run
hi loginagain
| Answer | What the tool does |
|---|---|
401 authentication_error, code token_expired | Refreshes the access token and retries once |
403 permission_error, code insufficient_scope | The sign-in lacks the scope; sign in again |
- Answer
- 401
authentication_error, codetoken_expired - What the tool does
- Refreshes the access token and retries once
- Answer
- 403
permission_error, codeinsufficient_scope - What the tool does
- The sign-in lacks the scope; sign in again
Shell
hi logouthi logout revokes the sign-in at HIPS and removes the stored tokens. To revoke a tool from anywhere, open Account in the Console, Authorized devices and apps, and revoke it there; it takes effect on the tool's next request.
HIPS Code, the company's coding agent, is the client hips-code with the scopes inference and account. Its sign-in shows the same code, QR code and link in the terminal, keeps the tokens in the keystore and sends the access token to the gateway; HIPS_API_KEY remains the path for CI and scripted use. Its row in the supported-tools matrix is the first one, unvalidated until tested Not decided yet.
Related sheets
- Sheet
- 10 of 13
- Detail
- A
- Updated
- 2026-10-21
- Status
- Preview