Skip to main content
sesame login registers your device with the Sesame broker by generating a local Ed25519 keypair and walking you through a one-click browser approval flow. Run it once on each machine where you want an agent to operate — your private key never leaves the device.

​
What happens during login

1

Keypair generation

The CLI generates an Ed25519 keypair on your device. The private key is written to local secure storage and never transmitted to the broker or any external service.
2

Claim URL opens in your browser

The CLI prints a one-time claim URL and attempts to open it automatically. If your browser does not open, copy the URL and paste it manually.
3

Approve the device in the Sesame dashboard

In the Sesame dashboard, review the device details — name, fingerprint, and timestamp — then click Approve. The CLI polls until it receives the confirmation.
4

Broker issues a signed JWT

Once approved, the broker issues a JWT signed with EdDSA and tied to your device’s public key. This token proves your identity on every subsequent request.
5

JWT stored locally

The CLI writes the JWT to local storage. It is automatically attached to every sesame request call from this device. You are now registered and ready to make authenticated requests.

​
Flags

​
flag
Register an additional agent on the same device. Each agent gets its own keypair and identity, which is useful when running multiple independent agents side by side — for example, a coding agent and a customer-support agent on the same laptop.

​
Refresh an expired token

Refreshes your JWT via a challenge-response exchange with your local device key. No browser interaction required — the broker issues a fresh token automatically if your device identity is still active.
sesame refresh runs automatically in the background whenever a token expires mid-session. You only need to call it manually if you see an auth: token expired error and want to resolve it without retrying the original request.

​
Switch the active agent

Changes the active agent for the current shell session. Useful when you have registered multiple agents with sesame login --new and want to direct requests through a specific identity.

​
Example output

A successful sesame login looks like this:
Run sesame status immediately after login to confirm your device fingerprint and token state before making your first request.