Signing in, and what your editor is allowed to do
How browser sign-in works, which workspace gets billed, what the editor can and cannot do with your account, and how to revoke it.
Updated September 2, 2026
ToolsXpo Code never asks you to paste an API key. It signs in through your browser using the OAuth device flow, the same mechanism the GitHub and AWS CLIs use.
How it works
- The editor asks ToolsXpo for a short code and opens your browser.
- You sign in — if you are not already — and see exactly what is being asked for.
- You choose which workspace the editor will bill to.
- You approve. A new API key is created, sent to your editor once, and never shown again.
The key is scoped to that workspace. Revoking it later leaves your other keys untouched.
What the editor is allowed to do
The approval screen lists this before you agree, and the key is issued with exactly those permissions and no more:
| Permission | What it means |
|---|---|
ai:chat | Send agent requests, spending the workspace's credits |
tools:run | Run tools from your catalogue |
mcp:connect | Connect to your ToolsXpo MCP server |
The editor deliberately does not ask for keys:manage. An editor has no business minting further API keys on your behalf.
Choosing the workspace
If you belong to more than one workspace — a personal one and an organisation, say — the approval screen lets you pick. This matters: the choice decides whose credits the agent spends.
Workspaces where your role does not allow issuing keys are shown but not selectable, with the reason. Ask an owner rather than guessing.
One sign-in, every app
The credential is stored in ~/.toolsxpo, which every ToolsXpo application reads. Signing in from the editor also signs in:
- the
toolsxpoCLI - the desktop app
- the JetBrains plugin
Signing out of any one of them signs out all of them. That symmetry is deliberate: a sign-out that leaves a working token on disk for three other apps is worse than one that fails loudly.
Revoking access
Go to Connected apps in your dashboard. Every editor, CLI and desktop client that holds a key is listed with when it was authorised, from which IP, when it was last used, and how many requests it has made.
Disconnect revokes that key immediately. The app sees a clean sign-in prompt on its next request; everything else keeps working.
What is shared
Your name, email, plan and credit balance, plus the model catalogue your workspace can call. Your code goes to the model you choose, per request, and is not retained by ToolsXpo — see Where your code goes.
Related
Quickstart: your first task with ToolsXpo Code
Install the extension, sign in from your browser, and give the agent its first task — about five minutes end to end.
Choosing a model
What the model picker shows you, why some models are greyed out, and how to search a catalogue of hundreds with filters.
What an agent task costs
How a ToolsXpo Code request is priced, what makes one task cheaper than another, and where to see what you spent.
Agent and scout tiers
Two reserved names — toolsxpo-agent and toolsxpo-scout — that let your workspace decide which model runs, without pinning it into the extension.