# Sign in a CLI or agent (/docs/getting-started/device-sign-in)

A command-line tool or a coding assistant on your computer can't open the log-in page itself. Instead it shows a short code and asks you to approve it in your browser, where you're already signed in. Once you approve, it acts as you, with your roles in your workspaces.

- **Who can use it:** Anyone with a Mokanata account.
- **Before you start:** Be signed in to Mokanata in your browser, and have the tool ready to sign in (for the Mokanata CLI, its log-in command).

## Approve a device code [#approve-a-device-code]

<Steps>
<Step>

### Start the sign-in in the tool [#start-the-sign-in-in-the-tool]

Run the tool's log-in command. It prints a code (for example `WDJB-MJHT`) and the address **app.mokanata.com/device**, and may open it for you.

</Step>
<Step>

### Open the device page [#open-the-device-page]

Go to **app.mokanata.com/device** in your browser. If you're not signed in, log in first (see [Log in](/docs/getting-started/log-in)). If you're signed in to several accounts, switch to the one the tool should use.

</Step>
<Step>

### Check the code and approve [#check-the-code-and-approve]

Type the code if it isn't filled in, and check that it matches the one in your terminal exactly. The page shows which app is asking. Click **Approve** to let it sign in, or **Deny** if you didn't start this.

</Step>
<Step>

### Back to the tool [#back-to-the-tool]

The tool notices the approval within a few seconds and finishes signing in. You can close the browser tab.

</Step>
</Steps>

<Callout type="warn" title="Only approve codes you started">
Never approve a code someone else sends you, in a message or on a call: approving it signs their tool in as you. If you didn't run the command yourself, click **Deny**.
</Callout>

## Codes that don't work [#codes-that-dont-work]

A code works once and expires after a few minutes. If the page says the code has expired, was already used or doesn't exist, run the tool's log-in command again and use the new code.

## Sign a tool out [#sign-a-tool-out]

A tool signed in this way shows up under **Where you're signed in** in [Settings → Security](/docs/settings/security). Sign it out there to cut it off. [API keys](/docs/settings/api-keys) for scripts that should act for the whole workspace are coming soon.

## Next steps [#next-steps]

<Cards>
<Card title="API keys (coming soon)" href="/docs/settings/api-keys" description="Keys for code and AI assistants are coming soon." />
<Card title="Passkeys, authenticator and devices" href="/docs/settings/security" description="See where you're signed in and sign out devices." />
</Cards>