# Signing in to Sovaria Workspace
Source: https://sovaria.in/docs/workspace-sign-in

How the Sovaria Workspace app signs in on Windows, macOS, Linux, Android and iOS (OAuth with PKCE through the console), how it shows up under Account › Security, and how to sign a device out.

**Get the app:** download Sovaria Workspace for Android, Windows, macOS or Linux at [sovaria.in/download](/download). Every file lists its version, size and SHA-256, and each version's SHA256SUMS.txt is signed with Sovaria's minisign release key `RWT4ZzEgYhg/3I5/DDajt0DIiSYXwCZzGIdL1Wnax4K8cKL6rbtHwd9P` (key ID DC3F1862203167F8). Check it with `minisign -Vm SHA256SUMS.txt -P <key>`; the key is the same on the download page and in the Sovaria Workspace repository.

**Sovaria Workspace** is Sovaria's own app for desktop and phone. It signs in with your Sovaria account through the console, like `sov login` does for the CLI, but it is an **app**, not a terminal: every sign-in shows under **Account › Security** as **Sovaria Workspace**, with the platform and app version, and you can sign each device out on its own.

## How sign-in works

1. **Choose Continue in browser** — The app opens the Sovaria console in your browser (on a phone, in a secure in-app browser tab). Sign in as usual; two-factor and passkeys work.
2. **Approve Sovaria Workspace** — The console asks **Authorize Sovaria Workspace?** and shows your account and where it returns to. Approve only if you just started signing in from the app.
3. **Back in the app** — On desktop the browser hands a one-time code to the app on this computer. On Android and iOS it opens the app; if your browser doesn't switch by itself, tap **Open the app**.

Under the hood this is OAuth 2.0 for native apps (RFC 8252) with PKCE (S256 only). The app never sees your password: it gets a one-time code, valid for 5 minutes and usable once, and exchanges it together with its secret PKCE verifier for a session.

| App | Returns to |
|---|---|
| Desktop (Windows, macOS, Linux) | `http://127.0.0.1:9876/callback`, a local address only that computer can reach |
| Android and iOS | `sovaria-workspace://auth/callback`, the app's own link |

> **Only the Sovaria Workspace app may use its link:** Sovaria accepts `sovaria-workspace://` only for the Sovaria Workspace app, and never for the CLI or other apps. Any other return address is refused before a code is created.

## Where it shows up

**Account › Security › Your devices** lists every sign-in. A Sovaria Workspace sign-in reads like **Sovaria Workspace · Android · 1.2.0**, with the device's name below, instead of a browser or terminal label; a CLI sign-in reads **Sovaria CLI**. **Sign out** ends that device's session right away, including any token it still holds.

API: `GET /api/v1/auth/sessions` returns each session with `client` (`{"id": "sovaria-workspace", "name": "Sovaria Workspace"}`, or `null` for a browser) and `device_info` (`platform`, `name`, `app_version`, `device_id`). `DELETE /api/v1/auth/sessions/{id}` signs one out.

## Token exchange (for app developers)

Sovaria Workspace sends its device with the code exchange. These fields only label the session; they grant nothing.

HTTP:
```bash
POST https://api.sovaria.in/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&client_id=sovaria-workspace
&code=<code from the redirect>
&redirect_uri=sovaria-workspace://auth/callback
&code_verifier=<PKCE verifier>
&device_id=<random id the app keeps, 8-128 of A-Z a-z 0-9 . _ : ->
&device_name=Asha's Pixel 8
&device_platform=android          # windows | macos | linux | android | ios
&app_version=1.2.0
```

Without device fields the session is still labelled **Sovaria Workspace**, with the platform read from the app's user agent.

## What the app shows from your organization

Signed in, the app reads the same data as the console, with your own permissions; it never fills a gap with a made-up number. When something can't be read it says so (for example **Visitors unavailable**), and changes such as paying or changing the plan open the console.

| In the app | Where it comes from | Who sees it |
|---|---|---|
| Plan, renewal date, payment method, invoices (Settings › Billing; phone: Settings › Plan & billing) | `GET /api/v1/billing/orgs/{org}/summary` ([Billing, invoices and overage](https://sovaria.in/docs/billing)) | Roles with **See plan, usage and invoices**; the card or UPI label only for the account that pays |
| Seats used and left (Billing, Members) | `GET /api/v1/org/{org}/seats` | Any member |
| Visitors and page views per site (Sites) | `GET /api/v1/fn/hosting/sites/{site}/visitors` ([App Builder: describe an app, Sovariq builds it on your backend](https://sovaria.in/docs/frontends)) | Members who can read functions |
| Project region | The project's database (`GET /api/v1/governance/tenants/{org}/databases`) | Members |
| New site templates | The app builder's gallery (`GET /api/v1/fn/hosting/frontends/templates`), the same list as the console | Members who can create apps |
| Agent runs today | `GET /api/v1/sovariq/agents/stats?since=` (counts only) | Members who can use Sovariq |
| All your chats with their mode; artifacts and decks from every chat | `GET /api/v1/sovariq/conversations?offset=`, `GET /api/v1/sovariq/artifacts` | You (your own chats only) |

Sovariq answers the same questions in any chat: `get_billing_summary` ("when does my plan renew?", "how many seats are left?") and `site_visitors` ("how many visitors did my site get this week?").