Sign in
onboarding

Poll an agent-started connection. After browser approval, collects the repository credential and the chosen workspace/Product binding.

Request states (AUTHORIZATION_PENDING, SLOW_DOWN, EXPIRED, ACCESS_DENIED, FORBIDDEN, PRODUCT_REQUIRED, KEY_CHOICE_CHANGED, ALREADY_REDEEMED, INVALID_REQUEST) come back as a machine-readable code with an error message and interval. The terminal ones close the request, so the next attempt starts a new one. Approval never creates a key; the key is created or reused, and any approved replacement is revoked, in one transaction when the agent collects. After collection, the device secret alone can never retrieve a credential again: resuming needs the exact bound key, as Bearer or as redemptionKey. Responses set Cache-Control: no-store.

post/api/v1/onboarding/repo/connect/token

Request body

deviceSecretstring required

The pm_pair_ secret returned by connect/start.

redemptionKeystring

A pm_live_ key the client generated for this request (64 hex characters after the prefix). When a new key is needed, the server stores only its hash. Sending the same value again resumes a collection whose response was lost.

sessionIdstring

The session returned by an earlier collection. With the exact bound key as Bearer, it resumes after the request itself has been cleaned up.

Response

Approved and collected; returns the binding and either the new apiKey or reusedCredential:true.

object required

Changes