Let your coding agent set it up

Your AI coding agent runs the OAuth 2.0 device flow and receives a scoped key. It never mints a credential on its own; a verified human approves before any key exists.

Agent Onboarding (Device Flow)

Your AI coding agent can set up Vorim for you. Instead of pasting an API key, the agent runs the OAuth 2.0 Device Authorization Grant (RFC 8628): it starts the flow, shows you a short code and a link, you approve once in the browser, and the agent receives a scoped key. The agent never mints a credential on its own. A signed in, email verified human approves before any key exists, and the key is clamped to a strict scope ceiling (agent registration and audit only).

The one call helper runs the approve and poll loop and, with registerAgent, also registers a first agent identity with the new key. It fails closed: it raises on denial, expiry, or timeout, and never returns a partial credential.

import { deviceLogin } from '@vorim/sdk';

// No API key needed to start. The agent runs this; you approve in the browser.
const { api_key, agent } = await deviceLogin({
  clientName: 'my-app',
  registerAgent: true, // also register a first agent identity with the new key
  onUserCode: ({ user_code, verification_uri }) => {
    // Show the human this, verbatim:
    console.log(`Approve at ${verification_uri} and enter code ${user_code}`);
  },
});

console.log('API key:', api_key);            // scope: agents:write, audit:write
console.log('Agent:', agent?.agent.agent_id); // first agent, ready to use
console.log('Private key:', agent?.private_key); // shown once, store it

typescript

The Python SDK mirrors it with device_login(register_agent=True).

from vorim import device_login

result = device_login(
    client_name="my-app",
    register_agent=True,
    on_user_code=lambda i: print(
        f"Approve at {i['verification_uri']} and enter code {i['user_code']}"
    ),
)
api_key = result["api_key"]
agent = result["agent"]  # first agent identity, with its one-time private_key

python

In an MCP client (Claude Desktop, Cursor) the agent drives it natively with the vorim_onboard_start and vorim_onboard_check tools, with no key required to begin. Or point any agent at the machine readable guide:

# Paste one line into your coding agent:
Read https://vorim.ai/agents.md and follow the device-flow bootstrap to get an
API key, then integrate per https://vorim.ai/docs

bash

How it stays safe

The unauthenticated start endpoint creates a pending request, not a credential. Only the hashes of the device and user codes are stored. The code is single use and expires in 10 minutes. The minted key is returned exactly once and is revocable in Settings. It expires in 90 days by default, and you can request a shorter lifetime at start, down to one day, so a short-lived task agent gets a key that dies with the task. The server caps the request at 90 days, so a malformed one can never mint a longer-lived key than policy allows. The agent automates the plumbing. It does not replace your consent.

Need Help?

Book a demo for a walkthrough, or contact us for support. For enterprise needs, reach out at sales@vorim.ai.