Approvals and sign-in
A machine with no browser, such as a server or an agent's computer, can still sign in to 0bridge or ask for your vault key. You approve it from your phone, and only the dashboard can approve a sign-in.
Last updated
The link comes first#
0b login and 0b setup print the sign-in link on its own line, then the code. In a terminal with room for it (at least 45 columns), they also print a QR code you can scan. Piped into an agent or a log, the link is plain text, so the agent can pass it to you as it is.
0b login --qr signin.png--qr <file.png> also saves the link as a PNG, for an agent that can show you an image. The QR code is made by 0bridge's own small encoder, with no extra package.
Approve a sign-in from the dashboard#
If the machine is told your account's email, it files a request for you to see: 0b login --email you@example.com, ZEROB_EMAIL, or an email baked into a prompt you copied from the dashboard. 0bridge keeps only a hash of that email for this, and the request lasts as long as the sign-in code does.
When you open the dashboard, the badge in the header counts it, and the Approvals page lists it with the machine's name, system, country and age. To approve:
- Pick the 2-digit number the terminal shows, from three choices. A wrong pick denies the request.
- Confirm it's you with your passkey, or an email code if you have none.
After that the machine continues on its own. If you do nothing, the request expires, and the link and code still work the old way.
- The request is only listed for the account whose email was given. Giving an email that has no account looks the same to the machine, so the form can't be used to find out who has one.
- At most 3 requests can be open for one email. A fourth is refused until one expires.
- A notification (ntfy or email, if you set one up under Settings) can tell you a machine is asking. It is on by default once you have a channel, and you can turn it off under Tell me about sign-in and vault requests. A notification only links to the Approvals page; it has no approve button.
- No device token, CLI command or chat app can approve a sign-in. Only you, signed in to the dashboard, can.
Vault key requests#
A machine that asks for your vault key shows a code, and you compare it with the one on the dashboard before approving. This stays a code comparison, not a number pick, because it guards the key exchange. For an agent computer, the approval page also warns you that anything running there can use every secret the vault opens.
0b vault unlock on a machine picks a saved request up again. The setup command for agent computers only asks and moves on, so it never waits on you.
Production approvals#
Approving production values for a machine (30 minutes, 2 hours or 8 hours) works as before: Secrets. The Approvals page lists those too, so one place shows everything waiting for you.
Why not approve from a notification#
A tap on a notification is easy to do by accident, and a sign-in request is the one thing an attacker would like to get you to approve. So approving takes the number you read off the machine, plus your passkey, in the dashboard.