Devices
A device is a browser paired with an organisation Agent. It signs in to one Space's app as that Agent, without a password, until it is disabled, revoked or expires. To pair one, see How to Pair a Device with an Agent. To set up an Agent and its first device from scratch, follow Your First Agent and Paired Device.
What a device can do
A device has exactly the Agent's permissions in its Space, through the Agent's Space role. It is never a Space admin, it cannot sign in to Ligantic itself, and it gains no organisation permissions. Removing the Agent's access to the Space stops the device from signing in.
A device is tied to:
- One Agent. To move a device to another Agent, revoke it and pair it again.
- One Space and its app address. If the app address changes, pair the device again.
- One browser profile. A device is a browser, not the machine it runs on: two browsers or profiles on one tablet are two devices. The device's key cannot be copied to another browser. Clearing the browser's site data removes it, and the browser must then be paired again.
The key protects against copying the sign-in to another browser or machine. It does not protect against software already running on the device's own browser or operating system.
States
State | Meaning | Can sign in | Can change to |
|---|---|---|---|
Enabled | Approved and usable. | Yes | Disabled, Revoked, Expired |
Disabled | Disabled on the device itself, or by an administrator. | No | Enabled (after an approved re-enable request), Revoked, Expired |
Revoked | Permanently removed by an administrator. | No | — |
Expired | Not used for longer than its inactivity period. | No | — |
Revoked and expired devices must be paired again as new devices.
Requests
Request | Created by | Becomes a device when |
|---|---|---|
New device | Pair a device in Ligantic | The device enters the code, and an administrator compares the confirmation and approves it. |
Re-enable | Request to sign back in on a disabled device | An administrator compares the confirmation and approves it. |
A request shows Waiting for device until the device proves its key, then Ready to compare with its confirmation.
Limits
Limit | Value |
|---|---|
Pairing code and request lifetime | 10 minutes from creation |
Pairing code attempts per Space | 20 per 10 minutes |
Pending requests per Agent | 5 |
Devices per Agent (enabled and disabled count; revoked and expired do not) | 10 by default, set by your plan |
Default inactivity period | 14 days |
Sign-out after disable or revoke | Within 30 seconds |
Device name | 1–250 characters, unique among the Agent's enabled and disabled devices, ignoring case |
Revoked and expired devices shown | Not shown by default; list them with the ended-devices API, or pass |
Devices do not use Agent seats. Lowering the device limit does not remove existing devices; it only blocks new approvals.
Inactivity
A device expires when it has not been used for its inactivity period. Using the app, or signing in again with its key, counts as use. Pending requests and approvals do not.
The organisation sets the default period under Devices on any Agent (Organisation inactivity period (days)). Shortening it can expire devices immediately. Lengthening it never revives an expired device. Use the API to set a different period for a single device.
Permissions
Organisation permission | Allows |
|---|---|
| Viewing an Agent's devices and requests |
| Starting a pairing (Pair a device) |
| Approving and cancelling requests |
| Renaming devices |
| Disabling devices |
| Revoking devices |
| Setting inactivity periods |
| Viewing the organisation Audit tab |
Organisation owners have all of them. A device logging itself out needs no organisation permission.
If device pairing is turned off for an organisation that already has devices, the Devices section stays on Agents with enabled or disabled devices, or outstanding requests. It offers only renaming, disabling, revoking and cancelling, with a note that new devices are not enabled. Existing devices keep signing in.
Audit
Organisations with device pairing enabled have an Audit tab. It lists every device event, newest first: pairing started, key proved, approved, cancelled, expired, renamed, disabled, revoked, re-enable requested and approved, and inactivity policy changes. Each event shows whether a member, the device itself or the system acted.
API and CLI
Operation | REST | CLI |
|---|---|---|
List devices and requests |
|
|
List older revoked and expired devices |
|
|
Start pairing |
|
|
Approve a request |
|
|
Cancel a request |
|
|
Rename |
|
|
Disable |
|
|
Revoke |
|
|
Set a device's inactivity period |
|
|
Set the organisation's inactivity period |
|
|
List audit events |
|
|
… is /api/v1/organisations/{organisationId}/agents/{agentId}. Inactivity periods are in milliseconds. The approve operation needs the request's confirmation, as shown on the device. The pairing code is returned only by the start-pairing operation.
Errors on the device page
Message | Cause |
|---|---|
Device sign-in is not enabled for this organisation. | New pairing and re-enable are not available for the organisation. |
That code has a typo. Check each digit with your administrator. | A digit was mistyped; the code was not sent. |
That did not work. Check the code, or ask your administrator for a new one. | Wrong, used, cancelled or expired code. |
Too many requests. Wait a minute and try again. | Rate limit reached. |
This browser cannot keep a device key here. | Not HTTPS, a private window, or an unsupported browser. |
This browser no longer has its device key… | Browser data was cleared. Pair again. |