Docs · Mac app

Sign in to DevOps for Mac

DevOps for Mac uses your htmltool.io account. You approve it once in your browser, and you can sign it out from any device at any time.

How signing in works

In DevOps for Mac, choose Sign in. The app opens htmltool.io in a secure browser window.
Sign in to htmltool.io, or create an account. If you're already signed in in that browser, this step is skipped.
htmltool.io asks: Allow DevOps for Mac to use your htmltool.io account? It shows the email address the app will be connected to. Choose Allow, or Cancel to stop.
The browser window closes and the app shows you as signed in.

Your password stays on htmltool.io

DevOps for Mac never sees your password or your social sign-in. It receives its own app session, which you can revoke without changing your password.

Devices and sessions

Each Mac you sign in on appears under Dashboard → Devices with its name, when it signed in, when it was last used and when its session expires.

Sessions last 30 days and renew when the app uses them, so a Mac you use regularly stays signed in. Renewal and the Last used time update at most once an hour.
Choose Revoke next to a device to sign it out. The app notices the next time it checks in and asks you to sign in again.
Signing out inside the app ends that device's session too.
Deleting your htmltool.io account signs out every device.

Lost or sold a Mac?

Revoke it from Devices. Nothing else on your account changes.

If sign-in doesn't finish

If you chose Cancel, nothing was connected. Start again from the app when you're ready.
The approval link is valid for a few minutes and works once. If the window sat open for a while, start again from the app.
If the browser says it can't open the app, make sure DevOps for Mac is installed and running, then try again.

For developers

The app signs in with OAuth 2.0 authorization code and PKCE (S256), as a public native client with no client secret. The values below are public; nothing here grants access by itself.

Client registration
Field	Value
client_id	`devops-mac`
redirect_uri	`htmltool-devops://auth/callback`
PKCE	`code_challenge_method=S256` (required)
Session lifetime	30 days, sliding

Endpoints

Sign-in endpoints
Endpoint	Purpose
GET /app/authorize	Browser page. Signs the user in if needed, asks for consent, then redirects to the app with a one-time code.
POST /api/app/token	Exchanges the code and `code_verifier` for an access token and the user.
GET /api/app/me	Validates a `Bearer` token and renews the session. Optional `X-Device-Name` header.
POST /api/app/sign-out	Revokes the token. Always 204, even if it was already revoked.

authorize.txt

https://htmltool.io/app/authorize?response_type=code
  &client_id=devops-mac
  &redirect_uri=htmltool-devops%3A%2F%2Fauth%2Fcallback
  &state=<random>
  &code_challenge=<base64url(SHA-256(verifier))>
  &code_challenge_method=S256

Allow redirects to htmltool-devops://auth/callback?code=…&state=…. Cancel redirects with error=access_denied. Codes expire after 5 minutes and work once. Invalid requests show an error page and never redirect.

token.http

POST https://htmltool.io/api/app/token
Content-Type: application/json

{
  "grant_type": "authorization_code",
  "code": "<code>",
  "code_verifier": "<verifier>",
  "client_id": "devops-mac",
  "redirect_uri": "htmltool-devops://auth/callback"
}

200 { "access_token": "…", "token_type": "Bearer", "expires_at": "<ISO-8601>", "user": { "id", "email", "name", "image" } }
400 { "error": "invalid_grant" | "invalid_request" | "unsupported_grant_type", "error_description": "…" }
429 { "error": "temporarily_unavailable", "error_description": "…" }   // Retry-After: <seconds>; 10 requests a minute per IP

session.http

GET https://htmltool.io/api/app/me
Authorization: Bearer <access_token>
X-Device-Name: <Mac name>

200 { "user": { … }, "session": { "id", "expires_at", "created_at" } }
401 { "error": "invalid_token" }   // unknown, expired, revoked or deleted user

POST https://htmltool.io/api/app/sign-out
Authorization: Bearer <access_token>

204

Keep tokens out of logs

Store the access token in the Keychain. Never put it in URLs or logs; the one-time code in the redirect is the only credential that travels in a URL.