agentsfleet · indykish · Aug 14, 2026 · Aug 14, 2026 · Aug 14, 2026 · Aug 14, 2026
diff --git a/api-reference/error-codes.mdx b/api-reference/error-codes.mdx
diff --git a/api-reference/introduction.mdx b/api-reference/introduction.mdx
@@ -3,8 +3,8 @@ title: API introduction
 description: Base URL, authentication, errors, and common response formats.
 type: explanation
 audience: user
-verified: 2026-07-22
-product_version: 0.25.0
+verified: 2026-08-14
+product_version: 0.26.2
 executable: false
 ---
 
@@ -24,7 +24,9 @@ Use the API when a script or service needs direct access. Use the command-line c
 
 Most paths accept a bearer token in the `Authorization` header. Tenant API keys start with `agt_t` and are shown once when created.
 
-Interactive users can sign in with `agentsfleet login`. The login flow saves a short-lived JSON Web Token (JWT).
+Interactive users sign in with `agentsfleet login`. Login saves a durable command-line credential that starts with `afc_`. The credential resolves to the person who signed in.
+
+The credential stays valid until a logout, a newer login from the same computer, or a dashboard revoke ends it.
 
 Webhook and connector paths use provider signatures instead of bearer tokens. The OpenAPI security section on each operation states the required method.
 

diff --git a/api-reference/scopes.mdx b/api-reference/scopes.mdx
@@ -3,8 +3,8 @@ title: API scopes
 description: Permissions that an agentsfleet access token can carry.
 type: reference
 audience: user
-verified: 2026-07-12
-product_version: 0.25.0
+verified: 2026-08-14
+product_version: 0.26.2
 executable: false
 ---
 
@@ -40,8 +40,6 @@ curl -s https://api.agentsfleet.net/v1/fleets -H 'Authorization: Bearer af_test_
 | `apikey:read` | Lists tenant API keys. | `apikey:write`, `apikey:admin` |
 | `apikey:write` | Creates and rotates tenant API keys. | `apikey:admin` |
 | `apikey:admin` | Revokes tenant API keys. | None |
-| `fleetkey:read` | Lists fleet keys. | `fleetkey:write` |
-| `fleetkey:write` | Creates and deletes fleet keys. | None |
 | `grant:read` | Lists integration grants. | `grant:write` |
 | `grant:write` | Revokes integration grants. | None |
 | `connector:read` | Reads connector state. | `connector:write` |
@@ -50,7 +48,7 @@ curl -s https://api.agentsfleet.net/v1/fleets -H 'Authorization: Bearer af_test_
 | `workspace:admin` | Creates and lists workspaces. | None |
 | `library:write` | Adds an entry to a workspace library. | None |
 | `platform-library:write` | Adds an entry to the platform library. | None |
-| `approval:read` | Reads pending approvals. | None |
+| `approval:read` | Reads pending approvals. | `approval:resolve` |
 | `approval:resolve` | Approves or denies a request. | None |
 
 Operator tokens may carry `runner:*`, `platform-key:*`, `platform-library:*`, `model:*`, or `workspace:any`. Tenant integrations do not need these scopes.

diff --git a/billing/budgets.mdx b/billing/budgets.mdx
@@ -4,7 +4,7 @@ description: Daily and monthly spending limits for one fleet.
 type: explanation
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/changelog.mdx b/changelog.mdx
@@ -7,6 +7,31 @@ description: "Stay up to date with the latest agentsfleet product updates, new f
   agentsfleet is in **stealth-mode testing** and pre-production. APIs and agent behavior may change between releases without long deprecation windows. Email [agentsfleet@agentmail.to](mailto:agentsfleet@agentmail.to) if you want a hand calibrating an agent or to join as a design partner.
 </Tip>
 
+<Update label="Aug 14, 2026" tags={["Breaking", "Security", "What's new"]}>
+  ## Login saves a credential that outlives the browser session
+
+  `agentsfleet login` used to save the browser session token it recovered, and that token is valid for about a minute. A terminal went stale while its operator was still reading the success message, and no renewal path exists. Login now spends that minute exchanging the session for a durable `afc_` credential, and the credential is what reaches disk. It resolves to the person who signed in rather than to the tenant, so an audit trail records who ran a command instead of a free-text label.
+
+  ## Breaking changes
+
+  - **`agentsfleet login --token` is gone.** The flag is refused as an unknown option rather than ignored. Piped input goes with it: a login with no terminal attached and no `AGENTSFLEET_API_KEY` fails and names that variable. Unattended callers set `AGENTSFLEET_API_KEY` to a tenant API key, which authenticates every request and writes nothing to disk.
+  - **`agentsfleet logout` no longer ends your dashboard session.** It revokes this computer's credential, aborts any unfinished sign-in, and clears local state. A browser session is a different credential class that refreshes through the identity provider, so signing out of a terminal leaves the dashboard you are reading signed in. A revoke that cannot reach the server still clears local state, and warns that the credential stays live until you revoke it from the dashboard.
+  - **A deployment that sets `OIDC_PROVIDER=custom` is refused at boot.** The value selected a second ladder that read capability and workspace claims from `custom_claims`, `app_metadata`, and namespaced keys, none of which anything writes. `OIDC_PROVIDER=clerk` is unchanged, so no deployment that runs today needs editing.
+
+  ## What's new
+
+  - **One live credential per computer.** A second login from the same computer revokes what it left behind, and `core.cli_credentials` carries a partial unique index, so two live credentials for one person and computer cannot be recorded at all. Only a hash is stored, so the credential cannot be read back from anywhere. `agentsfleet logout` is how a computer ends its own.
+  - **A credential records the server that issued it.** Later commands reach that server with no flag and no environment variable. The order is `--api`, then `AGENTSFLEET_API_URL`, then the recorded server, then the built-in URL. A saved credential that records no server, dialed at a server nobody named, is refused before anything is sent, with error code `DEPLOYMENT_UNKNOWN` and exit code `1`. The `logout` and `doctor` commands still run, because one ends a credential and the other explains the refusal.
+  - **Three error codes name what went wrong.** `UZ-AUTH-023` says the credential was revoked, `UZ-AUTH-024` says no live credential of yours has that identifier, and `UZ-AUTH-025` says login recovered a session but could not exchange it, so nothing was saved. A `401` or `403` from the client now names the API URL the credential was presented to.
+
+  ## Security
+
+  - **Minting a credential takes a browser sign-in.** A credential still authenticates listing and revoking, so a terminal can end its own access without opening a browser, but it cannot mint a replacement. Minting used to accept an existing credential, which turned one stolen credential into an unbounded supply under machine names of the caller's choosing.
+  - **A stored value is checked against its whole shape.** The load path and the mint response both require `afc_` followed by exactly 64 lower-case hexadecimal characters. A prefix check passed values carrying trailing bytes.
+  - **A tenant API key carries its creator's capabilities.** An `agt_t` key resolves its capability set from the identity provider, keyed on the `created_by` subject the key already stored, instead of a nine-entry set compiled into the binary that no operator could narrow. Narrowing that person narrows every key they minted, on the next request past the cache window. A creator the provider no longer knows resolves to no capability, and an unreachable provider past the staleness ceiling reports unavailable rather than an empty grant.
+  - **Each claim is read from exactly one key.** The capability claim is `scopes` and nothing else. The reader used to try OAuth2's `scope` first, so a token carrying both would have supplied a capability set we never granted, on the authorisation path. The `scp` spelling and the `workspaceId` alias are unread.
+</Update>
+
 <Update label="Aug 13, 2026" tags={["Breaking", "Bug fixes", "API"]}>
   ## Metered runs are priced from the model catalogue
 

diff --git a/cli/agentsfleet.mdx b/cli/agentsfleet.mdx
@@ -3,8 +3,8 @@ title: Command reference
 description: Commands available in the agentsfleet command-line client.
 type: reference
 audience: user
-verified: 2026-07-12
-product_version: 0.25.0
+verified: 2026-08-14
+product_version: 0.26.2
 executable: false
 ---
 
@@ -63,8 +63,8 @@ Commands:
 
 | Command | Effect |
 |---|---|
-| `agentsfleet login` | Signs in through a browser or supplied token. |
-| `agentsfleet logout` | Revokes every active session and clears local credentials. |
+| `agentsfleet login` | Signs in through a browser and saves a durable credential for this computer. |
+| `agentsfleet logout` | Revokes this computer's credential and any unfinished sign-in, then clears local credentials. Browser sessions stay signed in. |
 | `agentsfleet auth status` | Shows the token source, claims, and server status. |
 | `agentsfleet doctor` | Checks client settings, authentication, and API access. |
 
@@ -78,9 +78,6 @@ Commands:
 | `agentsfleet workspace show [WORKSPACE_ID]` | Shows one workspace. |
 | `agentsfleet workspace secrets` | Prints the secret command and dashboard path. |
 | `agentsfleet workspace delete <WORKSPACE_ID>` | Removes one workspace from local client state. Remote data remains. |
-| `agentsfleet fleet-key create` | Creates a key bound to one fleet. The raw key appears once. |
-| `agentsfleet fleet-key list` | Lists fleet keys without raw values. |
-| `agentsfleet fleet-key delete <FLEET_KEY_ID>` | Revokes a fleet key. Calls using that key fail. |
 | `agentsfleet api-key create` | Creates a tenant API key. The raw key appears once. |
 | `agentsfleet api-key list` | Lists tenant API keys. |
 | `agentsfleet api-key revoke <API_KEY_ID>` | Revokes a tenant API key. Calls using that key fail. |

diff --git a/cli/configuration.mdx b/cli/configuration.mdx
@@ -3,8 +3,8 @@ title: Client configuration
 description: Environment variables and value order for the agentsfleet client.
 type: reference
 audience: user
-verified: 2026-07-12
-product_version: 0.25.0
+verified: 2026-08-14
+product_version: 0.26.2
 executable: false
 ---
 
@@ -14,7 +14,9 @@ executable: false
 
 The client reads command options, environment variables, saved login data, and built-in defaults. A value earlier in the documented order wins.
 
-For authentication, `AGENTSFLEET_API_KEY` overrides the saved login token. The `login` command accepts `--token`, piped input, or browser approval.
+For authentication, `AGENTSFLEET_API_KEY` overrides the saved login credential. The `login` command approves in a browser. It accepts no token on the command line and reads no token from piped input.
+
+Login also records the server it signed into. Later commands reach that same server unless you name another one.
 
 ## Example with output
 
@@ -32,22 +34,26 @@ AGENTSFLEET_API_URL=https://api.agentsfleet.net agentsfleet --version
 |---|---|---|---|
 | `AGENTSFLEET_API_URL` | Sets the API base URL. | `https://api.agentsfleet.net` | URL beginning with `http://` or `https://` |
 | `AGENTSFLEET_DASHBOARD_URL` | Sets the browser login URL. | `https://app.agentsfleet.net` | URL beginning with `http://` or `https://` |
-| `AGENTSFLEET_API_KEY` | Authenticates every request and overrides saved login data. | None | Valid tenant API key |
+| `AGENTSFLEET_API_KEY` | Authenticates every request and overrides saved login data. Nothing is written to disk. | None | Valid tenant API key starting with `agt_t` |
 | `AGENTSFLEET_STATE_DIR` | Stores local credentials, settings, and telemetry consent. | `~/.config/agentsfleet` | Writable directory path |
 | `NO_COLOR` | Disables coloured output when set to `1`. | Unset | `1` or unset |
 | `AGENTSFLEET_TELEMETRY_DISABLED` | Disables usage telemetry when set to `1`. | Unset | `1` or unset |
 | `DO_NOT_TRACK` | Disables usage telemetry when set to `1`. | Unset | `1` or unset |
 | `AGENTSFLEET_TELEMETRY_DEBUG` | Prints telemetry details to standard error when set to `1`. | Unset | `1` or unset |
 
-The API URL uses this order: `--api`, `AGENTSFLEET_API_URL`, `.env.local`, then the built-in URL.
+The API URL uses this order: `--api`, `AGENTSFLEET_API_URL`, the server recorded at login, then the built-in URL.
 
 ## Errors
 
-An invalid URL returns exit code `4`. A missing token returns exit code `1`.
+An invalid URL returns exit code `4`. A missing credential returns exit code `1`.
 
 A network failure returns exit code `2`. The client does not change saved login data after a network failure.
 
-Do not put tokens in command history. Use `AGENTSFLEET_API_KEY` through your secret manager for unattended commands.
+A saved credential that records no server returns exit code `1` with error code `DEPLOYMENT_UNKNOWN`. Nothing is sent. Pass `--api <API_URL>`, set `AGENTSFLEET_API_URL`, or run `agentsfleet login` again.
+
+The `logout` and `doctor` commands still run in that state. One ends a credential and the other explains the refusal.
+
+Do not put credentials in command history. Use `AGENTSFLEET_API_KEY` through your secret manager for unattended commands.
 
 ## Related pages
 

diff --git a/cli/flags.mdx b/cli/flags.mdx
@@ -4,7 +4,7 @@ description: Options accepted by the agentsfleet command-line client.
 type: reference
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: true
 ---
 

diff --git a/cli/install.mdx b/cli/install.mdx
@@ -4,7 +4,7 @@ description: Install and remove the agentsfleet command-line client.
 type: how-to
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: true
 ---
 

diff --git a/concepts.mdx b/concepts.mdx
@@ -4,7 +4,7 @@ description: Understand tenants, workspaces, fleets, tools, events, and runs.
 type: explanation
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/concepts/context-lifecycle.mdx b/concepts/context-lifecycle.mdx
@@ -4,7 +4,7 @@ description: Learn how a fleet keeps useful context during long runs.
 type: explanation
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/docs.json b/docs.json
@@ -125,7 +125,9 @@
               "POST /v1/auth/sessions/{session_id}/verify",
               "DELETE /v1/auth/sessions/{session_id}",
               "DELETE /v1/auth/sessions/all",
-              "POST /v1/auth/identity-events/clerk"
+              "POST /v1/auth/identity-events/clerk",
+              "POST /v1/cli-credentials",
+              "DELETE /v1/cli-credentials/{id}"
             ]
           },
           {

diff --git a/fleets/authoring.mdx b/fleets/authoring.mdx
@@ -4,7 +4,7 @@ description: Create the two files that define a fleet.
 type: how-to
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/fleets/connectors.mdx b/fleets/connectors.mdx
@@ -4,7 +4,7 @@ description: Connect a workspace to GitHub, Slack, Zoho Desk, Jira, or Linear.
 type: how-to
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/fleets/install.mdx b/fleets/install.mdx
@@ -4,7 +4,7 @@ description: Install a fleet from your workspace library.
 type: how-to
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/fleets/library.mdx b/fleets/library.mdx
@@ -4,7 +4,7 @@ description: Understand platform and workspace library entries.
 type: explanation
 audience: user
 verified: 2026-08-10
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/fleets/overview.mdx b/fleets/overview.mdx
@@ -4,7 +4,7 @@ description: Understand what a fleet owns and how its lifecycle works.
 type: explanation
 audience: user
 verified: 2026-07-21
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/fleets/running.mdx b/fleets/running.mdx
@@ -4,7 +4,7 @@ description: Inspect, message, stop, resume, kill, and delete a fleet.
 type: how-to
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/fleets/secrets.mdx b/fleets/secrets.mdx
@@ -4,7 +4,7 @@ description: Store, replace, inspect, and delete workspace secrets.
 type: how-to
 audience: user
 verified: 2026-07-29
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/fleets/tools.mdx b/fleets/tools.mdx
@@ -4,7 +4,7 @@ description: Understand the tools that a fleet can call.
 type: explanation
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/fleets/troubleshooting.mdx b/fleets/troubleshooting.mdx
@@ -4,7 +4,7 @@ description: Find and fix common fleet failures.
 type: troubleshooting
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/fleets/webhooks.mdx b/fleets/webhooks.mdx
@@ -4,7 +4,7 @@ description: Send signed provider events to a fleet.
 type: how-to
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/index.mdx b/index.mdx
@@ -4,7 +4,7 @@ description: Create and run event-driven fleets.
 type: explanation
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/memory.mdx b/memory.mdx
@@ -4,7 +4,7 @@ description: Learn what a fleet can remember between events.
 type: explanation
 audience: user
 verified: 2026-07-18
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/quickstart.mdx b/quickstart.mdx
@@ -4,7 +4,7 @@ description: Install your first fleet and send it a GitHub event.
 type: tutorial
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/scripts/check-documentation.py b/scripts/check-documentation.py
@@ -100,7 +100,7 @@
     "UDP",
     "URL",
 }
-EXPECTED_VERSION = "0.25.0"
+EXPECTED_VERSION = "0.26.2"
 NON_PAGE_CODE_SNIPPETS = {Path("snippets/rates.mdx")}
 ERROR_REFERENCE_PRIVATE_TERMS = {
     "API_MAX_",

diff --git a/scripts/test-documentation.py b/scripts/test-documentation.py
@@ -24,7 +24,7 @@
 type: explanation
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/workspaces/managing.mdx b/workspaces/managing.mdx
@@ -4,7 +4,7 @@ description: Create, select, inspect, and remove local workspace entries.
 type: how-to
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---
 

diff --git a/workspaces/overview.mdx b/workspaces/overview.mdx
@@ -4,7 +4,7 @@ description: Understand what a workspace owns and separates.
 type: explanation
 audience: user
 verified: 2026-07-12
-product_version: 0.25.0
+product_version: 0.26.2
 executable: false
 ---