# Bayes developer platform

> The Bayes developer docs and developer account API require a developer token. Request a token here, and then have someone with an approved Bayes developer account approve it in their browser. You only need curl and a standard shell.

## Get a developer token

1. Request a code:

   curl -s -X POST https://platform.getbayes.com/api/cli/device -H 'Content-Type: application/json' -d '{"kind":"developer","label":"<your agent> on <machine>, repo <repo>"}'

   The response contains device_code, user_code, verification_uri_complete, interval (in seconds), and expires_in (600 seconds).

2. Tell the person: "Open <verification_uri_complete>, sign in, confirm that the page displays <user_code>, and approve it. The code expires in 10 minutes."
   Ask someone to approve only a code that you requested yourself. If they do not have a Bayes developer account, they can request one at https://platform.getbayes.com/request-access. Bayes manually reviews these requests, so request a new code after they are approved.

3. Await approval. This loop repeatedly checks for approval, saves the token to a private file, and never prints it:

   DC='<device_code>'; I=5
   while :; do
     r=$(curl -s -X POST https://platform.getbayes.com/api/cli/device/token -H 'Content-Type: application/json' -d "{\"device_code\":\"$DC\"}")
     case $r in
       *access_token*) (umask 077; mkdir -p ~/.config/bayes; printf '%s' "$r" > ~/.config/bayes/token.json); echo approved; break;;
       *authorization_pending*) sleep $I;;
       *slow_down*) I=$((I+5)); sleep $I;;
       *) echo "$r"; break;;
     esac
   done

   If your shell times out, rerun the loop using the same device_code. If you receive "access_denied" or "expired", stop and notify your person. The token is displayed only once.

4. Use the token. You can find it in the access_token field in ~/.config/bayes/token.json. The following line reads it with sed, so you do not need to install anything else:

   export BAYES_DEVELOPER_TOKEN=$(sed -n 's/.*"access_token":"\([^"]*\)".*/\1/p' ~/.config/bayes/token.json)

   If your shell does not preserve variables between commands, run that line in the same command as each request.
   Include it in this header: Authorization: Bearer $BAYES_DEVELOPER_TOKEN
   Send it only to https://platform.getbayes.com. Never commit it, print it, or include it in application code or a deployment. Bridge and Vault do not accept it.

   Start here. With the token, this file serves as the complete documentation index:
   printf 'Authorization: Bearer %s\n' "$BAYES_DEVELOPER_TOKEN" | curl -s -H @- https://platform.getbayes.com/llms.txt

## What the token can do

Use the token to read all Bayes developer documentation and act on the Bayes developer account belonging to the person who approved it:

- Directly: read the account and its settings, including key metadata but never the value of an existing key or webhook secret; update sandbox settings, keys, and secrets.
- With that person's approval (the API returns 202 with a code to present to them): change production and personal settings, keys, and secrets, as well as make every other organization, production, or personal change.

A new key or secret is returned only once. Rolling a key or rotating a secret immediately invalidates the old value, so do not perform either action while anything still depends on it.

The token expires after 30 days unless the person who approved it selected a different duration, or after 14 days without use. If a response returns token_expired, repeat these steps. To renew early, send your current token in the Authorization header in step 1.