Getting a token without a browser

vatio login is the normal route, and these paths are how it works. They are not workspace-scoped and take no developer token — they are how you obtain one.

A custom CLI starts device authorization with POST /cli/device_authorizations. The response supplies device_code, user_code, verification URLs, interval, and expires_in.

Have the user open verification_uri_complete, then poll POST /cli/device_authorizations/token with { "device_code": "..." } at the supplied interval. GET /cli/workspaces lists workspaces and POST /cli/workspaces creates one with slug and optional name, using the resulting developer token.