Runbook: device approval

Every machine that runs Surfil is a device linked to your account with an Ed25519 device token - no API key ever lives in a dotfile. This runbook covers approving and revoking devices.

Approve a device

1. On the machine, run surfil login. It starts a device flow (RFC 8628) and prints a short code.
2. Open Devices and choose Approve a device.
3. Enter the code. If you have a passkey, a step-up is required. Only approve codes you started yourself.

$ surfil login
→ enter code ABCD-1234 at surfil.com/dashboard/activate

Revoke a device

From the Deviceslist or a device's detail page, choose revoke. Revocation is real and fail-closed: the device is refused a signed output on its next call. Revoke immediately if a machine is lost or leaves the team.