Getting a token without a browser

vatio login is the normal route, and these paths are how it works. They are not workspace-scoped and take no developer token — they are how you obtain one.

A custom CLI starts device authorization with POST /cli/device_authorizations. The response supplies device_code, user_code, verification URLs, interval, and expires_in.

Send an email in the body and, rather than leaving the user hunting for a URL, we mail them the link and the response carries email_sent: true. That link creates the account if it did not exist, signs them in, and lands on the same approval page — which still wants the click, so an email scanner that opens it authorizes nothing. Print the user_code in your terminal: the email carries the same one, and comparing them is what replaces typing it.

Have the user open verification_uri_complete, then poll POST /cli/device_authorizations/token with { "device_code": "..." } at the supplied interval. GET /cli/workspaces lists workspaces and POST /cli/workspaces creates one with slug and optional name, using the resulting developer token.