Skip to main content
MasterSkills authenticates machines, not sessions. Each machine you use gets its own device token through a one-time browser approval — after that, the CLI and your agents work on that machine indefinitely, like an SSH key.

​
The login flow

  1. The CLI requests a device code and prints a short confirmation code.
  2. Your browser opens masterskills.dev/device. Sign in (GitHub or Google — there are no passwords), confirm the code, and pick the organization this device belongs to.
  3. The CLI, which has been polling, receives a lifetime device token and stores it locally. Done — this machine never logs in again.
The organization chosen at approval becomes the device’s home org: the default namespace for publishing and the anchor for plan limits. If you belong to no organization yet, the approval page has you create one on the spot.

​
Where credentials live

The token is stored in ~/.masterskills/config.json (override the directory with MASTERSKILLS_HOME). The server stores only a sha256 hash of the token — the token itself exists on your machine alone. masterskills logout deletes the local credentials. For CI and service use, the MASTERSKILLS_TOKEN environment variable takes precedence over the stored token — see Publish from CI.

​
Revocation

Every authorized device is listed in the panel with its name and last-seen time. From there you can:
  • Revoke any single device — its token stops working immediately; the CLI on that machine gets a 401 and asks for a fresh masterskills login.
  • Sign out everywhere — revoke all of your devices at once.
Devices are also revoked automatically when a member leaves or is removed from the organization.

​
Plan limits

The Free plan allows one device per user — a second login is refused with device_limit. Team and Enterprise plans have no device limit. Current plans and pricing: masterskills.dev/pricing.