Security & tokens
The Omni Loop Portal is designed so there's nothing dangerous to leak. There are no standalone API keys — the only credential is a connected Clioloop device.
Tokens
- Devices authenticate with short-lived access tokens (about 1 hour).
- Refresh tokens are single-use and rotate on every refresh.
- Refresh-token reuse is treated as theft: the whole device session family is revoked instantly (OAuth 2.1 semantics). Lose a laptop, and replaying its old token kills the family.
- All tokens are stored hashed (SHA-256) — the portal never keeps plaintext credentials.
No API keys
Connecting uses an RFC 8628 device-code flow: approve in the browser, and the agent receives rotating tokens automatically. See Getting started for the walkthrough.
Read-only Fusion panels
In Agentic Fusion, planner and reviewer models are read-only at the schema level — write, shell and browser tools aren't in their toolset at all. They can research and critique, but only your main model can act, and you can watch it.
Token troubleshooting
| Error | What to do |
|---|---|
authorization_pending forever | The browser approval was never completed. Re-run login and approve at /activate within 15 minutes. |
card_verification_required | Free-plan inference unlocks after the one-time €0 card verification — open your dashboard and click Verify card. |
refresh_token_reused | An old refresh token was replayed (often a backup/restore of ~/.clio across machines). Re-authenticate with clio auth add managed. |