Accounts, identity & tokens

Everything in Hub happens in the context of an account, and every API call is authenticated by a token.

API: the auth service — request flows, plus its endpoint reference to try calls live.

Identity vs. account

Your identity is who you log in as. An identity can own multiple accounts — for example a personal user account and one or more org accounts. When you operate on resources (devices, objects, trails), you act in the context of one account, which owns those resources.

The web UI signs you into your account; the API uses tokens scoped to it.

Authentication

The UI authenticates with OAuth2 / PKCE: you sign in, and the browser obtains a short-lived access token (refreshed as needed) that it sends as Authorization: Bearer <token> on API calls.

You can strengthen sign-in with two-factor authentication and passkeys so a password alone can't reach your account — see Two-factor & passkeys.

Tokens carry hints about what kind of principal they represent — a user token vs. a device token — and which account is responsible.

Token types

Token	Used by	Created in the UI under
API token	Scripts, CI, automation acting as you	Tokens (/tokens)
Device token	A device authenticating to the cloud	Device tokens (/devices/tokens)

Tokens are shown once at creation — treat them like passwords. Use API tokens to automate anything the UI can do (it all goes through the same API); use device tokens to provision devices non-interactively (see Start a new device).