Sign in with Openference

Deyin never asks you to paste provider API keys. Instead it authenticates you with Openference — the unified LLM gateway — using OAuth 2.0 with PKCE (Proof Key for Code Exchange). Your access token authorizes every model call from both the desktop app and the CLI.

Choose “Sign in with Openference” on first launch. A native browser window opens for consent; the app captures the loopback redirect locally. Tokens are refreshed automatically and stored encrypted via your operating system's keychain.

Credentials live in ~/.deyin/credentials.json with 0600 permissions and refresh automatically. The CLI uses the same OAuth client and scopes as the desktop app.

Your access token authorizes model calls through the Openference gateway according to your plan's rate limits. It is also used for identity sync (registering your workstation), plan management in Settings → Plans, and diagnostics uploads — always scrubbed of secrets before leaving the device.

Access tokens are short-lived (about an hour) and rotate automatically using the refresh token issued at sign-in. Refreshes happen offline — you are never prompted mid-task.

Signing out revokes the refresh token with the gateway and clears ~/.deyin/credentials.json. Workspaces keep their local caches; only identity is removed.

The CLI and desktop app request identical scopes. Nothing else is requested, and any scope expansion requires a new consent screen — you will always see why.