Poll a CLI sign-in
Exchange a device code for a personal API token. While the user has not approved the sign-in, the response is 400 with an error field of authorization_pending or slow_down — wait for the returned interval and poll again. access_denied and expired_token are terminal. On approval, the endpoint provisions the user and a default organization when needed, and returns a personal API token with a 90 day expiry. Set interactive to true to get a workspace list and a scope catalog instead of a token, then finish with POST /cli/login/complete. This endpoint does not require authentication.
Body
Device code from POST /cli/login. Never show this code to the user.
Optional scopes for the minted token. The server always includes the minimum scopes scans:read, scans:write, and billing:read. The member's role limits the final set. Without this field, the server applies a default scope set.
scans:read, scans:write, vulnerabilities:read, vulnerabilities:write, dependencies:read, schedules:read, schedules:write, assets:read, assets:write, organizations:read, organizations:write, members:read, members:write, invitations:read, invitations:write, webhooks:read, webhooks:write, tokens:write, audit:read, pr_reviews:read, pr_reviews:write, connectors:read, connectors:write, knowledge:read, knowledge:write, uploads:write, integrations:read, integrations:write, chat:read, chat:write, scans:message, analytics:read, llm:read, llm:write, test_users:read, test_users:write, license:read, supply_chain:read, supply_chain:write, billing:read, billing:write Named CLI authority preference. Minimal grants scans and billing:read. Recommended adds every scope that everyday strix cloud commands use: vulnerabilities, dependencies, supply chain, schedules, assets, knowledge, PR reviews, connectors, chat, uploads, integrations, analytics, license, webhooks:read, audit:read, organizations:read, organizations:write, and billing:write. Full means the session's approved ceiling after login and adds account administration (members, invitations, tokens, webhooks:write, LLM, test users). Custom requires an explicit scopes array. The member's role caps every profile.
minimal, recommended, full, custom Opaque stable identifier for this CLI installation. Send with device_name to reuse one session row on later sign-ins.
8 - 128Privacy-safe device label shown in API Access. Required with client_instance_id.
1 - 80When true, approval returns selection_required with the user's workspaces, the scope catalog, and a short-lived selection_token instead of a token. Finish with POST /cli/login/complete.
Response
Sign-in complete, or a selection step when interactive is true. The api_token field contains the raw secret — store it securely.
- Option 1
- Option 2
Raw personal API token secret. Only returned at sign-in time.
Expiry of the API token.
True when this sign-in created the account.
Scopes granted to the minted token.
scans:read, scans:write, vulnerabilities:read, vulnerabilities:write, dependencies:read, schedules:read, schedules:write, assets:read, assets:write, organizations:read, organizations:write, members:read, members:write, invitations:read, invitations:write, webhooks:read, webhooks:write, tokens:write, audit:read, pr_reviews:read, pr_reviews:write, connectors:read, connectors:write, knowledge:read, knowledge:write, uploads:write, integrations:read, integrations:write, chat:read, chat:write, scans:message, analytics:read, llm:read, llm:write, test_users:read, test_users:write, license:read, supply_chain:read, supply_chain:write, billing:read, billing:write Maximum authority approved for this session at login.
scans:read, scans:write, vulnerabilities:read, vulnerabilities:write, dependencies:read, schedules:read, schedules:write, assets:read, assets:write, organizations:read, organizations:write, members:read, members:write, invitations:read, invitations:write, webhooks:read, webhooks:write, tokens:write, audit:read, pr_reviews:read, pr_reviews:write, connectors:read, connectors:write, knowledge:read, knowledge:write, uploads:write, integrations:read, integrations:write, chat:read, chat:write, scans:message, analytics:read, llm:read, llm:write, test_users:read, test_users:write, license:read, supply_chain:read, supply_chain:write, billing:read, billing:write scans:read, scans:write, vulnerabilities:read, vulnerabilities:write, dependencies:read, schedules:read, schedules:write, assets:read, assets:write, organizations:read, organizations:write, members:read, members:write, invitations:read, invitations:write, webhooks:read, webhooks:write, tokens:write, audit:read, pr_reviews:read, pr_reviews:write, connectors:read, connectors:write, knowledge:read, knowledge:write, uploads:write, integrations:read, integrations:write, chat:read, chat:write, scans:message, analytics:read, llm:read, llm:write, test_users:read, test_users:write, license:read, supply_chain:read, supply_chain:write, billing:read, billing:write Named CLI authority preference. Minimal grants scans and billing:read. Recommended adds every scope that everyday strix cloud commands use: vulnerabilities, dependencies, supply chain, schedules, assets, knowledge, PR reviews, connectors, chat, uploads, integrations, analytics, license, webhooks:read, audit:read, organizations:read, organizations:write, and billing:write. Full means the session's approved ceiling after login and adds account administration (members, invitations, tokens, webhooks:write, LLM, test users). Custom requires an explicit scopes array. The member's role caps every profile.
minimal, recommended, full, custom api, cli Setup state of the workspace that received the token. Omitted when the server cannot read the live workspace state. The token is still valid in that case.
One short paragraph with the first commands to run after sign-in. When the workspace still has its default name, the text names the rename command for a session with organizations:write, and tells other sessions to ask a workspace admin or to sign in again with the full profile. When onboarding.github_install_url is present, the text tells the person to open the link. When the session also has integrations:write, the text names the command that creates a new link. When the workspace can still start the Cloud plan trial and the new session can call the billing checkout operation, the text also offers the trial. The session must have the billing:write scope and no asset scopes.
Suggested first actions, in order. Each item names the CLI command and the matching API operation. Setup steps come first: name the workspace when the session has organizations:write and the workspace still has its default name, and connect GitHub when the session has integrations:write, no asset scopes, and onboarding.github_install_url is present. A deployment without the GitHub App never gets the GitHub step. When the workspace can still start the Cloud plan trial and the new session can call the billing checkout operation, the last item starts the trial. The session must have the billing:write scope and no asset scopes.
URL of the Strix dashboard.