Pair a device

Every person and every machine that talks to a hub has a device of its own: keys made on that machine, registered at the hub once. There is no password and no shared account. vai up paired the first device as the owner; this is how the next ones join.

Invite, then pair

On an owner’s device:

$ vai pair invite --role operator --name ci-1

It prints one string, valid for 10 minutes. On the new device:

$ vai pair <invite>

The new device brings up a tunnel with the invite’s temporary key, registers its own keys and their protection level, pins the hub’s certificate authority, and from then on uses its own key. The role is the invite’s, not the new device’s choice.

Roles

role	may
owner	everything, including tokens, keys, the licence and deletes
operator	operate: releases, backups, restores, access, twins; deletes with the name typed
viewer	read

Protection levels

A device registers how its signing key is protected, and the hub caps what it may do by that level. Only a device of level presence (a key that asks a person for each use: the Secure Enclave with Touch ID, a TPM with a PIN) can be an owner or approve anything. A CI box with a key file can be an operator, and a production delete from it waits for a person’s approval. The table is on keys and devices.

List and revoke

$ vai devices
$ vai devices revoke ci-1 --confirm ci-1

Revoking a device revokes its agent keys and every access it holds.

Next: your first environment.