Device sign-in replaces registering and minting tokens over the API
A tool asks for a code, the person approves it in their browser (signing in or registering there), and the tool collects a token. Accounts are now created only on the website; no endpoint takes a password. - identity: device_start, device_lookup, device_resolve, device_claim - api: /v1/device/code and /v1/device/token; /v1/register and /v1/tokens removed - site: /device approval page; sign-in and registration return to where the person was going - llms.txt and docs rewritten around the new flow
No changes
This commit changes no files.