Device login

Login flow

Run:

rye auth login

Rye starts a device-code login flow. After the user completes the browser step, the local CLI receives workspace credentials and the device becomes known to Rye.

One-time bootstrap token

If you have a one-time bootstrap token from the Rye dashboard, use:

rye auth login --bootstrap-token

Rye prompts you to paste the token, then exchanges it for a signed-in session. The flag selects the interactive prompt; it does not take the token as a command-line argument.

Check or end a session

Check whether you are signed in:

rye auth status
rye auth status --json

Sign out locally:

rye auth logout

Local logout and workspace device revocation are separate actions.

Why device identity matters

Device identity gives audit records a stable local anchor. A useful record should answer:

• Which user started the agent?
• Which workspace policy was active?
• Which device ran the session?
• Which local tool was supervised?
• Which policy allowed, redacted, or blocked the request?

Revocation model

When a machine should no longer run supervised AI tools, revoke the device from the workspace. Future requests from that device should be denied even if a local agent still has model-provider credentials in its environment.

Session attribution

Authentication is also how Rye connects local traffic to app-side records. Without device login, a proxy may still see network traffic, but the audit trail is missing the user and workspace context security teams need.