Park a sign-in for the CLI to collect

POST

/security/cli-logins

The relay for prorm login, for browsers that cannot reach the CLI's
loopback listener. What is parked is stored encrypted under the
SHA-256 of the one-time state the CLI printed, for five minutes, and
delivered once at GET /security/cli-logins/{state}. A second
approval for the same state replaces the first.

v2 (v: 2): the console parks the device-bound grant it just
opened at POST /security/klock/sessions, with grant and
sessionId (and optionally deviceCert, deviceId, keyset). The
grant must be one this API signed, for a live session of the
caller's own. Only the device key it names can use it.

v1: a bearer token — one already minted at
/security/sessions/cli (it must be the caller's own), or a new one.
Under enforcement E3 this answers 410 login_v2_required.

Request

Body Params application/jsonRequired

Examples

Responses

🟢202

application/json

Parked for five minutes

Bodyapplication/json

🟠400

🟠403

🔴503

🟠401KlockUnauthorized

🟠410LoginV2Required

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.prod-orm.io/security/cli-logins' \
--header 'Content-Type: application/json' \
--data '{
    "state": "string",
    "hostname": "string",
    "days": 1,
    "token": "stringstringstringst",
    "v": 1,
    "grant": "stringstringstringst",
    "sessionId": "string",
    "deviceCert": "string",
    "deviceId": "string",
    "keyset": "string"
}'

Response Example

202 - Example 1

{
    "message": "string",
    "expiresAt": "2019-08-24T14:15:22.123Z"
}

Modified at 2026-10-05 14:01:12

A token for the customer console, from the staff one

The CLI collecting its sign-in