> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useveil.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Paired devices

> Pair machines to your Veil account with veil login. Each paired device gets a scoped API key that lives in the OS keychain.

API keys are created automatically when you pair a machine with the CLI. You do not create keys from the dashboard — instead you run `veil login` on each machine that needs access, confirm the pairing in your browser, and the CLI stores a scoped key in the OS keychain.

## Pairing a machine

Install the CLI and run:

```bash theme={null}
npx @useveil/cli login
```

The command prints a pairing code and opens your browser. Confirm the pairing in the Veil dashboard. When confirmed, the CLI stores a sandbox key and, if your account has completed live verification, a live key as well.

Each paired machine appears in **Settings → Paired Devices** with its device name, active modes, and last-used timestamp.

## Mode coverage

A paired device can hold up to two keys — one for sandbox and one for production. Sandbox is available as soon as you pair. Production requires completing the [Go-Live flow](/developers/production/go-live-flow) first.

The CLI picks the right key automatically based on the `--mode` flag or the active mode set with `veil config set mode`.

## Revoking a device

To revoke a paired device, open **Settings → Paired Devices**, find the device, and click **Revoke**. This immediately invalidates every key associated with that device. The next API call from that machine will return an authentication error. The device can be re-paired at any time with `veil login`.

## Headless and CI environments

On headless machines where a browser is unavailable, use `--with-token` to store a key directly without the browser flow:

```bash theme={null}
veil login --with-token $VEIL_SANDBOX_KEY
```

Generate the key from a machine you have already paired, then pass it to the headless environment as a secret.

## See also

* [Mode toggle](/developers/production/mode-toggle) — switching between sandbox and production
* [Sandbox vs. production](/concepts/sandbox-vs-production) — per-mode key isolation
* [Go-Live flow](/developers/production/go-live-flow) — completing live verification to unlock the production key surface