Description
Marketplace Device Authorization lets a command-line consumer authenticate to the hosted Marketplace without asking the user to paste a password into a terminal. The client starts a device flow, receives a short user code and browser verification URL, and polls for a decision. The user signs in on the server-rendered verification page and approves or denies the device. Approval produces the Marketplace service’s own session bearer, which the client can cache and reuse for entitlement-gated operations.
The browser-safe Marketplace client owns the client flow. Device codes expire, approved codes are consumed once through an atomic state transition, and polling reports explicit pending, approved, denied, or expired states. Production and local authentication modes both issue the same Marketplace bearer shape, keeping downstream clients independent of the underlying account provider.
Selling Points
- Keeps passwords out of command histories and third-party terminal prompts.
- Uses a short human-readable code and a familiar browser approval step.
- Gives CLI consumers a reusable token for free and paid entitlement checks.
- Makes approval, denial, expiration, and polling state explicit.
- Preserves one downstream bearer contract across local and hosted authentication modes.
User Story
A buyer runs a Marketplace command on a new machine. With no token in the environment or local cache, the CLI prints a verification URL and short code. The buyer opens the URL, signs in to Marketplace, confirms the displayed code, and approves the device. The waiting CLI receives a session token, caches it for that Marketplace origin, and continues the entitlement-gated operation without ever seeing the buyer’s password.
Extension Surface
The capability is automatable. Clients can invoke and poll the typed flow through packages/marketplace-client/src/install/device-login.ts, and callers may supply their own fetch implementation around that contract. The server’s code lifetime, polling semantics, atomic consumption, and token issuance in apps/marketplace/src/services/device-auth-service.ts are fixed security behavior rather than configurable extension points.
Capabilities & Limits
The flow can start a device authorization, render browser verification, accept approve or deny decisions, poll safely, issue a reusable bearer, and support client-side token caching. It gives CLI tools a first-party authentication path without embedding an interactive browser.
It does not purchase a listing, bypass entitlement checks, or authorize an unknown device indefinitely. Codes expire, approved codes are single-use, and a cached token is scoped by Marketplace origin. The device page is HTML rather than part of the JSON OpenAPI surface.
Implementation Map
packages/marketplace-client/src/install/device-login.tsapps/marketplace/src/routes/auth-device.tsapps/marketplace/src/services/device-auth-service.tsapps/marketplace/src/auth/session-token.ts