Device trust
Device trust is based on installation identity, not derived from MAC address, serial number, or device name. Signed in, online, reachable, and trusted are different states.
Installation identity
The CLI generates and persists a random installation identity on first run. A device name helps recognition but is not sufficient trust evidence by itself.
State differences
| State | Meaning |
|---|---|
| Signed in | The machine holds currently valid account credentials |
| Online | The account directory sees a device connection |
| Directly reachable | The current client can access the Local API |
| Pending | The new identity is registered and awaits approval by a trusted device |
| Trusted | Both sides confirmed device identity for supported E2EE control |
| Workspace authorized | The target CLI allows a remote agent to use a specific directory |
Establish and revoke
Compare the identity or fingerprint displayed on both sides when establishing trust. A new device may appear as Pending until a trusted App approves it. Trust covers device identity and encrypted control; it does not grant workspace, provider, or Agent permission by itself.
Normal sign-out keeps the local E2EE identity so the device can be recognized on its next sign-in. Choosing “Sign out and remove this device” on the device itself deletes its local device key; revoking a remote device only removes account trust and does not remotely delete its local key or workspace files.
Inspect or rotate local security state with:
originrouter security status
originrouter security rotate