div login

div login
div login --no-browser

div login prints a code like QZHR-LVKG and opens the dashboard at /cli with it. Check that the code on the page matches the one in the terminal, then approve. The terminal collects an API key on its next poll and saves it.

Code: QZHR-LVKG
Opened https://divergentlabs.xyz/cli?code=QZHR-LVKG — approve it there if the code matches.
Waiting for the browser…
Signed in to Divergent as founder@divergentlabs.xyz.
The key is "div on MacBook-Pro.local", saved to /Users/you/.config/divergent/config.json. Revoke it under Settings to sign this machine out.

Flags

Flag	What it does
--no-browser	print the link instead of opening it
--api-url <url>	sign in to a different control plane, and keep using it

Over SSH, or with --no-browser, it prints the link for you to open wherever your browser is.

Where the key goes

The key is saved to ~/.config/divergent/config.json — or under XDG_CONFIG_HOME, when that is set. The file is readable only by its owner, and it is written beside itself and renamed over, so a CLI killed halfway leaves the old file rather than half of a new one. Anything else in the file is left alone.

--api-url is saved with the key, so a login against a local control plane keeps talking to it. A login against production leaves no URL behind to go stale.

If DIVERGENT_API_KEY is set in the shell, it wins over the saved key, and div login prints:

DIVERGENT_API_KEY is set in this shell and wins over the saved key; unset it to use this one.

What the key can do

The key is named div on <hostname>, belongs to whoever approved it, and carries runs:read runs:write storage:read storage:write — enough to place runs, read their logs and move files.

Revoke it under Settings in the dashboard to sign that machine out. A key that needs other scopes is made there by hand.

How it works

This is RFC 8628’s device flow. The terminal polls with a device code that never leaves it, and the API stores only that code’s digest. The key is minted when the terminal collects it, so no raw token sits in a row waiting. A code lasts ten minutes and works once.

Approving takes a dashboard session, never an API key.