Connected devices

A connected device is anywhere you're signed in — a browser, or a machine running the acira CLI. They're all listed in the app under Settings → Devices, with the device name, location, and when it was last used, and you can revoke any of them.

Connecting the CLI

There's nothing to create or paste. Sign in from the terminal and that machine becomes a connected device on your account:

acira login     # enter your email, then the 6-digit code we send you
acira whoami    # show who you're signed in as

acira init runs this for you as part of setup, so you rarely need login on its own.

A CLI sign-in lasts 90 days from the day you sign in, whether or not you use it in the meantime — after that you sign in again. In the last 14 days the CLI warns you on every command, so you can renew during ordinary work instead of mid-publish.

A device reaches exactly what your account reaches and nothing more, and revoking one doesn't affect the others.

Credentials for automation

CI and other unattended jobs can't answer an emailed code, so they use an automation credential you mint from a machine that's already connected:

acira token create "github-actions" --expires 180d

The credential is printed once — copy it straight into your CI secret store. Pass it to the CLI as the ACIRA_TOKEN environment variable; there's no command-line flag for it, so it stays out of your shell history and process list.

An expiry is required — at least 15 days, at most a year. We email the account 14 days before it lapses, so nobody discovers it mid-deploy. Mint a replacement and swap the secret before that date.

Automation credentials are deliberately limited. They can build, publish, and read logs, but they can't sign in a new device, mint further credentials, set up an agency, or pay for anything. Those stay human-only, so a leaked CI secret can't extend itself.

Reviewing and revoking

Settings → Devices lists everything connected to your account — browsers and CLI machines together — including when each one expires. Revoke any single device, or sign out everywhere at once.

The same list is available from the terminal:

acira devices   # list connected devices, with revoke
acira logout    # disconnect the machine you're on

Good practices

• One automation credential per pipeline, so you can revoke one without disrupting the rest.
• Mint automation credentials from an admin account. A credential belongs to the account that created it — see CLI workflow for why that matters on an agency team.
• Keep automation credentials in the environment, never in a file you commit.
• Revoke what you no longer use — a laptop you've replaced, a pipeline you've retired.
• Review the list when someone leaves, the same way you'd review repository access.