# Approve a CLI sign-in

Command-line tools such as the [`cafe` CLI](https://staging.git.cafe/docs/getting-started/cli.md) sign in
with a device code. The tool shows a code like `ABCD-EFGH` and opens `/device`
in your browser, usually with the code filled in.

## Approve the sign-in

1. Sign in to GitCafe if asked; you return to the same code afterwards.
2. Choose **Continue** to see the permissions the tool is asking for.
3. Optionally select extra permissions (below).
4. Choose **Approve**, or **Deny** to refuse.
5. Return to your terminal.

The approved login lasts 90 days. Codes are eight characters, and are not case
sensitive. A mistyped, used or expired code is refused; start again from the
tool. You may be asked to [confirm it's you](https://staging.git.cafe/docs/account/account-settings.md#confirm-its-you)
before approving.

## Optional permissions

Both are off by default. Logins you already approved do not gain them; sign in
again to change your choice.

- **Also allow editing my public profile and pinned repositories** enables the
  [profile commands](https://staging.git.cafe/docs/account/profile.md#edit-your-profile-from-the-cli).
- **Also allow managing my tokens and SSH/GPG keys** lets the CLI create,
  rotate and revoke your tokens and keys. Only allow this for tools you trust:
  credentials they create can outlive the login.

Without the second permission, the CLI can list your public keys and inspect or
revoke its own token. It can never rotate the token it is using: run
`cafe auth login` again, then revoke the old login from **Settings → Tokens**.

## Revoke a CLI login

CLI logins appear in **Settings → Tokens**. Revoke one there, or run
`cafe auth logout` on the machine to remove its stored credentials.