Device registration, encrypted workspace keys, and recovery are core parts of Ondago’s security model. This guide walks through the actions that give your devices access to your work.
Register a new device#
- Sign in on the new computer or browser.
- Use the verification method shown on the new device: enter your six-digit authenticator code (set up under Settings → Account), or request and enter the eight-digit emailed code when offered.
- Follow the workspace access prompts to transfer keys or recover them.
- Open a known saved session to confirm that this device can decrypt it.
On the CLI, begin with ondago login. A registration prompt may direct you to ondago devices prove CODE. The old device-approval flow has been replaced; do not look for a second device to approve sign-in.
Sign-in and encryption access are separate#
Signing in lets Ondago identify your account. A registered device also needs the workspace encryption key to open stored sessions. A device can be signed in and still need a key transfer or recovery step.
When the flow asks an existing device to transfer a key, use the request shown by that flow:
ondago devices transfer-key REQUEST_CODETransfer applies to a device that has already completed device verification.
Keep a recovery kit#
During setup, copy your recovery kit into a password manager or download the file. Confirm that you saved it somewhere safe, then choose Continue. Keep the kit somewhere you can still access if this computer or browser is lost. Ondago cannot recover the passphrase for you. Never include the kit, its QR codes, private keys, or recovery secrets in a screenshot or support message.
For the CLI workspace recovery flow:
ondago keys escrow
ondago keys recoverThe first command sets a recovery passphrase; the second uses the configured passphrase to recover access. These are separate actions, normally performed at different times.
Remove a device you no longer use#
Open Settings → Devices. Each computer is one row, with its browsers and terminal sign-ins grouped under it. Choose Remove on a row to cut the whole computer off, or Details to see each part and remove one (Remove for a device, Revoke for a terminal sign-in, Sign out for a browser). The computer you are using has no Remove. From a terminal, use:
ondago devices list
ondago devices revoke DEVICE_IDDesktop, the CLI and each browser profile have separate identities, even on the same computer. Review the client kind, last-seen time and this-app marker before removing one. Removing one identity does not sign out the others.
Check the device identity before revoking it. Removing access cannot recall data that the device already decrypted. Forgetting a computer from the Sessions list and revoking an account device serve different purposes; use the access controls when removing authorization.
Share diagnostic information privately#
For a support screenshot, replace or hide account addresses, computer names, private repository names and paths, session titles, and conversation content unless needed to explain the issue. Never share authentication tokens, device private keys, authenticator QR codes, or recovery material. Check the full screenshot, including tool output and the address bar, before sending.