> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seraph.si/llms.txt
> Use this file to discover all available pages before exploring further.

# Accounts & linked devices

> How a launcher, a game and the website all end up signed in to the same Seraph account.

Everything Seraph knows about you hangs off one **Seraph account**, and that account is your Discord
identity. Nothing else is a login: there is no Seraph password to forget, and no separate account per
install.

Each thing you sign in becomes a **session** on that account. The launcher is one, every game you
sign in is another, and the website is a third. Sessions are listed, labelled and revocable, so
signing out one device never disturbs the rest.

## Linking the launcher

The launcher signs in through your browser the first time you run it:

<Steps>
  <Step title="The launcher opens Discord">
    It sends you to `auth.seraph.si/v4/oauth/authorize`, which hands you on to Discord's own
    consent screen.
  </Step>

  <Step title="You approve">
    Discord asks whether Seraph may see who you are. Seraph never sees your Discord password
    and never asks for one.
  </Step>

  <Step title="The launcher receives a session">
    Discord returns you to Seraph, the launcher exchanges the result for a token, and writes it
    to `token.json` in your Seraph folder.
  </Step>
</Steps>

Because the token is written to the shared Seraph folder, every client on that machine, Lunar,
Badlion or Forge, picks up the same session without signing in again.

## Linking a game

A game cannot catch a browser redirect the way the launcher can, so it uses a **device code**
instead: it shows you a short code, you approve it wherever it is convenient, and the game waits.

<Steps>
  <Step title="Run the command">
    ```
    /seraph login
    ```

    Seraph prints a short code and a link.
  </Step>

  <Step title="Approve the code">
    Seraph opens [auth.seraph.si/device](https://auth.seraph.si/device) for you, and clicking
    the code in chat opens it with the code already filled in. Sign in with Discord if you are
    not already, and confirm the code matches the one on your screen. The code is good for
    **15 minutes**.
  </Step>

  <Step title="The game picks it up">
    The game is polling in the background and says `Signed in. Seraph is connected to this game.`
    as soon as you approve. Nothing needs restarting.
  </Step>
</Steps>

<Warning>
  A code only ever grants what you approve while looking at it. If a code appears that you did not
  ask for, or someone asks you to approve one "for support", do not: approving it links **their**
  game to **your** account. Seraph staff will never ask you to approve a device code.
</Warning>

Until you approve, the code buys nothing, so a code read aloud on a stream is worthless by the time
anyone acts on it. Running `/seraph login` again while one is waiting repeats the same code rather
than starting a rival sign-in, and signing a game in that was already signed in retires the session
it replaces.

## Seeing what is linked

```
/seraph sessions
```

lists every device signed in to your account, with the client that signed it in and the label it
was given, and marks the one you are playing on. The same list, with more detail, is on your account
page.

```
/seraph account
```

opens [seraph.si/account](https://seraph.si/account), where each session shows when it was created,
when it was last seen and when it expires.

## Unlinking

| What you want                        | How                                                                        |
| ------------------------------------ | -------------------------------------------------------------------------- |
| Sign this game out                   | `/seraph logout`, which revokes the session rather than just forgetting it |
| Sign out everything except this game | `/seraph sessions signout-others`                                          |
| Sign out one specific device         | Your account page                                                          |
| Sign out everything                  | Your account page                                                          |

Revoking a session takes effect immediately: the device holding it cannot renew, and its next
request fails. Anything signed out has to go through the flow again to come back.

<Danger>
  `token.json` **is** your session. Seraph will never ask you for it, and no genuine support
  process involves sending it to anyone. If you have shared it, or run a "Seraph" build from
  somewhere that was not `seraph.si`, sign out every device from your account page straight away.
</Danger>

## Your Hypixel key is linked too

Your Hypixel API key is held on your Seraph account rather than in one install's config:

```
/seraph apikey <key>
```

saves it to the account, so every install you sign in picks it up automatically. Run it with no
key to be walked through getting one. See [API keys & login](/docs/getting-started/api-keys) for
where the key comes from and what it is used for.

Clearing it on your account page removes it everywhere. It is only ever sent to Hypixel and to
Seraph's own proxy, and if you have set your own key or proxy, Seraph's proxy is not used at all.

## What each credential is

| Credential           | Where it lives               | What it is for                                                |
| -------------------- | ---------------------------- | ------------------------------------------------------------- |
| Seraph session token | `token.json`                 | Proves this device is signed in to your account. Never share. |
| Hypixel API key      | Your Seraph account          | Reading stats from Hypixel.                                   |
| Seraph API key       | Given out by the Discord bot | External tools such as Cubelify. Not a login.                 |

A Seraph API key is not a way to sign in, and a session token is not an API key. Neither is your
Discord account: revoking Seraph's access from Discord's own settings stops new sign-ins, but
existing sessions are ended from your account page.