Signing in to Sovaria Workspace

Get the app: download Sovaria Workspace for Android, Windows, macOS or Linux at sovaria.in/download. Every file lists its version, size and SHA-256, and each version's SHA256SUMS.txt is signed with Sovaria's minisign release key RWT4ZzEgYhg/3I5/DDajt0DIiSYXwCZzGIdL1Wnax4K8cKL6rbtHwd9P (key ID DC3F1862203167F8). Check it with minisign -Vm SHA256SUMS.txt -P <key>; the key is the same on the download page and in the Sovaria Workspace repository.

Sovaria Workspace is Sovaria's own app for desktop and phone. It signs in with your Sovaria account through the console, like sov login does for the CLI, but it is an app, not a terminal: every sign-in shows under Account › Security as Sovaria Workspace, with the platform and app version, and you can sign each device out on its own.

#How sign-in works

1. 1

   Choose Continue in browser

   The app opens the Sovaria console in your browser (on a phone, in a secure in-app browser tab). Sign in as usual; two-factor and passkeys work.

2. 2

   Approve Sovaria Workspace

   The console asks Authorize Sovaria Workspace? and shows your account and where it returns to. Approve only if you just started signing in from the app.

3. 3

   Back in the app

   On desktop the browser hands a one-time code to the app on this computer. On Android and iOS it opens the app; if your browser doesn't switch by itself, tap Open the app.

Under the hood this is OAuth 2.0 for native apps (RFC 8252) with PKCE (S256 only). The app never sees your password: it gets a one-time code, valid for 5 minutes and usable once, and exchanges it together with its secret PKCE verifier for a session.

#Where it shows up

Account › Security › Your devices lists every sign-in. A Sovaria Workspace sign-in reads like Sovaria Workspace · Android · 1.2.0, with the device's name below, instead of a browser or terminal label; a CLI sign-in reads Sovaria CLI. Sign out ends that device's session right away, including any token it still holds.

API: GET /api/v1/auth/sessions returns each session with client ({"id": "sovaria-workspace", "name": "Sovaria Workspace"}, or null for a browser) and device_info (platform, name, app_version, device_id). DELETE /api/v1/auth/sessions/{id} signs one out.

#Token exchange (for app developers)

Sovaria Workspace sends its device with the code exchange. These fields only label the session; they grant nothing.

POST https://api.sovaria.in/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&client_id=sovaria-workspace
&code=<code from the redirect>
&redirect_uri=sovaria-workspace://auth/callback
&code_verifier=<PKCE verifier>
&device_id=<random id the app keeps, 8-128 of A-Z a-z 0-9 . _ : ->
&device_name=Asha's Pixel 8
&device_platform=android          # windows | macos | linux | android | ios
&app_version=1.2.0

Without device fields the session is still labelled Sovaria Workspace, with the platform read from the app's user agent.

#What the app shows from your organization

Signed in, the app reads the same data as the console, with your own permissions; it never fills a gap with a made-up number. When something can't be read it says so (for example Visitors unavailable), and changes such as paying or changing the plan open the console.

Sovariq answers the same questions in any chat: get_billing_summary ("when does my plan renew?", "how many seats are left?") and site_visitors ("how many visitors did my site get this week?").