Each machine running FOKS has its own device key. When you sign up, a device key is created for that machine. To use FOKS on a second machine, you provision it using an existing device as a helper — this is the key-exchange (KEX) process.
Provision this device for FOKS using an existing provisioned device as a helper.Run this on the new device. It will display a code. On an already-provisioned device, approve the request:
# On the new devicefoks device provision# Follow the prompts — on the existing device, you'll be asked to approve
The provisioning flow uses a secure key-exchange protocol. The new device’s key is added to your user key set, and team keys are shared with the new device automatically.
To revoke a device (e.g., a lost or stolen laptop), use the web admin panel or (coming soon) a CLI command. Revoking a device triggers key rotation for all teams the user belongs to.
foks admin web # open the admin panel to manage devices
After revocation, the FOKS agent on other devices will detect the revocation and rotate all affected keys in the background.
YubiKey hardware tokens act as a special kind of device. See YubiKey for details.
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"foks","colors":{"primary":"#16A34A","light":"#07C983","dark":"#15803D"},"logo":{"light":"https://mintcdn.com/ne43inc/aybqQiAnWDo38yVm/logo/light.svg?fit=max\u0026auto=format\u0026n=aybqQiAnWDo38yVm\u0026q=85\u0026s=01622f2fc8259ee722847c05ebad8192","dark":"https://mintcdn.com/ne43inc/aybqQiAnWDo38yVm/logo/dark.svg?fit=max\u0026auto=format\u0026n=aybqQiAnWDo38yVm\u0026q=85\u0026s=0fdc9489ab7422f7282f100b322188e8"},"favicon":"https://mintcdn.com/ne43inc/aybqQiAnWDo38yVm/favicon.svg?fit=max\u0026auto=format\u0026n=aybqQiAnWDo38yVm\u0026q=85\u0026s=5d8b9f9378aff0c5edcd6ab65b5fc2c1","navbar":{"links":[{"href":"https://foks.pub","label":"foks.pub"}],"primary":{"type":"button","label":"Sign Up","href":"https://w.foks.app"}},"footer":{"socials":{"github":"https://github.com/foks-proj/go-foks"}},"styling":{"latex":false},"navigation":{"global":{"anchors":[{"anchor":"GitHub","icon":"github","href":"https://github.com/foks-proj/go-foks"},{"anchor":"foks.app","icon":"cloud","href":"https://w.foks.app"}]},"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"ne43inc","hasAudioNarration":false,"actualSubdomain":"ne43inc","customDomains":["docs.foks.pub"],"gitSource":{"type":"github","owner":"foks-proj","repo":"docs","deployBranch":"main","contentDirectory":"","isPrivate":false,"mountPath":"","label":""},"chroma":{"liveDeploymentHistoryId":"6a21eba07fd5f14b8ebb1e51","collectionId":"0dec3cd4-7170-442b-93d0-abac3a231c39","schemaVersion":"v2"},"entitlements":{},"buildId":"6a21eba07fd5f14b8ebb1e51:success","clientVersion":"0.0.3869","searchFilterCounts":[{"language":"default","tag":"Guides","count":19},{"language":"default","tag":"CLI Reference","count":9},{"language":"default","tag":"Self-Hosting","count":4},{"language":"default","tag":"Core Concepts","count":3},{"language":"default","tag":"Getting Started","count":3}]},"assistantConfig":{"enableAskAiButton":false,"enableStarterQuestions":false,"enableAskAiSearchBar":true},"hasChatPermissions":false,"hasWebMcpPermissions":false,"toggles":[],"isAtlas":false,"googleFontsInlined":false},"customCss":[],"page":{"pagePath":"cli/device","slug":"/cli/device","pageMetadata":{"title":"foks device","description":"Provision and manage devices.","href":"/cli/device","hidden":false},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Provision and manage devices.\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){const _components={a:`a`,code:`code`,p:`p`,pre:`pre`,span:`span`,strong:`strong`,..._provideComponents(),...props.components},{CodeBlock,Heading}=_components;if(!CodeBlock)_missingMdxReference(`CodeBlock`,true);if(!Heading)_missingMdxReference(`Heading`,true);return _jsxs(_Fragment,{children:[_jsx(Heading,{level:`2`,id:`overview`,children:`Overview`}),`\n`,_jsx(_components.p,{children:`Each machine running FOKS has its own device key. When you sign up, a device key is created for that machine. To use FOKS on a second machine, you provision it using an existing device as a helper — this is the key-exchange (KEX) process.`}),`\n`,_jsx(Heading,{level:`2`,id:`commands`,children:`Commands`}),`\n`,_jsx(Heading,{level:`3`,id:`provision`,children:`provision`}),`\n`,_jsx(CodeBlock,{numberOfLines:`2`,language:`text`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`text`,children:_jsxs(_components.code,{language:`text`,numberOfLines:`2`,children:[_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:`foks device provision`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})})]})})}),`\n`,_jsx(_components.p,{children:`Provision this device for FOKS using an existing provisioned device as a helper.`}),`\n`,_jsxs(_components.p,{children:[`Run this on the `,_jsx(_components.strong,{children:`new`}),` device. It will display a code. On an already-provisioned device, approve the request:`]}),`\n`,_jsx(CodeBlock,{filename:``,numberOfLines:`4`,language:`shellscript`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`shellscript`,children:_jsxs(_components.code,{language:`shellscript`,numberOfLines:`4`,children:[_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#6E7781`,\"--shiki-dark\":`#6A9955`},children:`# On the new device`})}),`\n`,_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#953800`,\"--shiki-dark\":`#DCDCAA`},children:`foks`}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` device`}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` provision`})]}),`\n`,_jsx(_components.span,{className:`line`}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{style:{color:`#6E7781`,\"--shiki-dark\":`#6A9955`},children:`# Follow the prompts — on the existing device, you'll be asked to approve`})}),`\n`]})})}),`\n`,_jsx(_components.p,{children:`The provisioning flow uses a secure key-exchange protocol. The new device’s key is added to your user key set, and team keys are shared with the new device automatically.`}),`\n`,_jsx(Heading,{level:`3`,id:`make-permanent`,children:`make-permanent`}),`\n`,_jsx(CodeBlock,{numberOfLines:`2`,language:`text`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`text`,children:_jsxs(_components.code,{language:`text`,numberOfLines:`2`,children:[_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{children:`foks device make-permanent`})}),`\n`,_jsx(_components.span,{className:`line`,children:_jsx(_components.span,{})})]})})}),`\n`,_jsx(_components.p,{children:`Promote a temporary device key to a permanent one. Temporary keys are created during some provisioning flows and expire after a short time.`}),`\n`,_jsx(Heading,{level:`2`,id:`revoking-a-device`,children:`Revoking a Device`}),`\n`,_jsx(_components.p,{children:`To revoke a device (e.g., a lost or stolen laptop), use the web admin panel or (coming soon) a CLI command. Revoking a device triggers key rotation for all teams the user belongs to.`}),`\n`,_jsx(CodeBlock,{filename:``,numberOfLines:`1`,language:`shellscript`,children:_jsx(_components.pre,{className:`shiki shiki-themes github-light-default dark-plus`,style:{backgroundColor:`#ffffff`,\"--shiki-dark-bg\":`#0B0C0E`,color:`#1f2328`,\"--shiki-dark\":`#D4D4D4`},language:`shellscript`,children:_jsxs(_components.code,{language:`shellscript`,numberOfLines:`1`,children:[_jsxs(_components.span,{className:`line`,children:[_jsx(_components.span,{style:{color:`#953800`,\"--shiki-dark\":`#DCDCAA`},children:`foks`}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` admin`}),_jsx(_components.span,{style:{color:`#0A3069`,\"--shiki-dark\":`#CE9178`},children:` web`}),_jsx(_components.span,{style:{color:`#6E7781`,\"--shiki-dark\":`#6A9955`},children:` # open the admin panel to manage devices`})]}),`\n`]})})}),`\n`,_jsx(_components.p,{children:`After revocation, the FOKS agent on other devices will detect the revocation and rotate all affected keys in the background.`}),`\n`,_jsx(Heading,{level:`2`,id:`yubikey-devices`,children:`YubiKey Devices`}),`\n`,_jsxs(_components.p,{children:[`YubiKey hardware tokens act as a special kind of device. See `,_jsx(_components.a,{href:`/cli/yubikey`,children:`YubiKey`}),` for details.`]})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"foks device","description":"Provision and manage devices.","href":"/cli/device","hidden":false}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[{"title":"Overview","slug":"overview","depth":2,"children":[]},{"title":"Commands","slug":"commands","depth":2,"children":[{"title":"provision","slug":"provision","depth":3,"children":[]},{"title":"make-permanent","slug":"make-permanent","depth":3,"children":[]}]},{"title":"Revoking a Device","slug":"revoking-a-device","depth":2,"children":[]},{"title":"YubiKey Devices","slug":"yubikey-devices","depth":2,"children":[]}],"codeExamples":{}},"jsLinks":[],"subdomain":"ne43inc","siteName":"foks","title":"foks device - foks","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-02-23T13:32:12.217Z","originalFileLocation":"cli/device.mdx"},"headHtml":"\u003cmeta data-mint-head name=\"description\" content=\"Provision and manage devices.\">\u003cmeta data-mint-head name=\"application-name\" content=\"foks\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/ne43inc/4p2es6eiIybNfhUX/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/ne43inc/4p2es6eiIybNfhUX/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/ne43inc/4p2es6eiIybNfhUX/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/ne43inc/4p2es6eiIybNfhUX/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/ne43inc/4p2es6eiIybNfhUX/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/ne43inc/4p2es6eiIybNfhUX/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/ne43inc/4p2es6eiIybNfhUX/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/ne43inc/4p2es6eiIybNfhUX/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/ne43inc/4p2es6eiIybNfhUX/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"foks device - foks\">\u003cmeta data-mint-head property=\"og:description\" content=\"Provision and manage devices.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"foks\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.foks.pub/cli/device\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"foks device - foks\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Provision and manage devices.\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/ne43inc/4p2es6eiIybNfhUX/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"foks\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#16A34A\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.foks.pub/cli/device\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/cli/device.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://docs.foks.pub/#organization\",\"name\":\"foks\",\"url\":\"https://docs.foks.pub\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/ne43inc/aybqQiAnWDo38yVm/logo/light.svg?fit=max\u0026auto=format\u0026n=aybqQiAnWDo38yVm\u0026q=85\u0026s=01622f2fc8259ee722847c05ebad8192\"}},{\"@type\":\"WebSite\",\"@id\":\"https://docs.foks.pub#website\",\"name\":\"foks\",\"url\":\"https://docs.foks.pub\",\"publisher\":{\"@id\":\"https://docs.foks.pub/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.foks.pub/cli/device#webpage\",\"url\":\"https://docs.foks.pub/cli/device\",\"name\":\"foks device\",\"description\":\"Provision and manage devices.\",\"dateModified\":\"2026-02-23T13:32:12.217Z\",\"isPartOf\":{\"@id\":\"https://docs.foks.pub#website\"},\"breadcrumb\":{\"@id\":\"https://docs.foks.pub/cli/device#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.foks.pub/cli/device#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"CLI Reference\",\"item\":\"https://docs.foks.pub/cli/overview\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"foks device\",\"item\":\"https://docs.foks.pub/cli/device\"}]},{\"@type\":[\"Article\",\"TechArticle\"],\"@id\":\"https://docs.foks.pub/cli/device#article\",\"headline\":\"foks device\",\"name\":\"foks device\",\"description\":\"Provision and manage devices.\",\"url\":\"https://docs.foks.pub/cli/device\",\"mainEntityOfPage\":{\"@id\":\"https://docs.foks.pub/cli/device#webpage\"},\"dateModified\":\"2026-02-23T13:32:12.217Z\",\"publisher\":{\"@id\":\"https://docs.foks.pub/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.foks.pub#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"foks\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"foks","nav":{"global":{"anchors":[{"anchor":"GitHub","icon":"github","href":"https://github.com/foks-proj/go-foks"},{"anchor":"foks.app","icon":"cloud","href":"https://w.foks.app"}]},"tabs":[{"tab":"Guides","groups":[{"group":"Getting Started","pages":[{"title":"Introduction","description":"FOKS is an open-source, federated protocol for end-to-end encrypted Git hosting and secret storage.","href":""},{"title":"Installation","description":"Install the FOKS CLI on your platform.","href":"/installation"},{"title":"Quickstart","description":"Sign up, create an encrypted Git repository, and push your first commit.","href":"/quickstart"}]},{"group":"Core Concepts","pages":[{"title":"Architecture","description":"How FOKS processes and components fit together.","href":"/concepts/architecture"},{"title":"Security Model","description":"Cryptographic primitives, threat model, and trust assumptions.","href":"/concepts/security"},{"title":"Federation","description":"How FOKS servers discover each other and how teams can span multiple servers.","href":"/concepts/federation"}]},{"group":"CLI Reference","pages":[{"title":"CLI Overview","description":"The foks command-line tool.","href":"/cli/overview"},{"title":"foks git","description":"Create and manage end-to-end encrypted Git repositories.","href":"/cli/git"},{"title":"foks kv","description":"End-to-end encrypted key-value store.","href":"/cli/kv"},{"title":"foks team","description":"Create and manage teams with role-based access control.","href":"/cli/team"},{"title":"foks device","description":"Provision and manage devices.","href":"/cli/device"},{"title":"foks yubikey","description":"Use a YubiKey as a hardware device key.","href":"/cli/yubikey"},{"title":"foks mcp","description":"Model Context Protocol (MCP) servers for LLM tool integration.","href":"/cli/mcp"},{"title":"foks agent \u0026 ctl","description":"The FOKS background agent and how to control it.","href":"/cli/agent"},{"title":"foks bot","description":"Create and use bot tokens for automated deployments and CI/CD.","href":"/cli/bot"}]},{"group":"Self-Hosting","pages":[{"title":"Self-Hosting Overview","description":"Run your own FOKS server.","href":"/server/overview"},{"title":"Server Setup","description":"Step-by-step guide to setting up your own FOKS server.","href":"/server/quickstart"},{"title":"Configuration Reference","description":"FOKS server configuration file and options.","href":"/server/configuration"},{"title":"Virtual Hosts","description":"Run multiple isolated FOKS instances on a single server.","href":"/server/virtual-hosts"}]}]}]},"title":"foks device - foks","buildId":"dpl_DMQXxPZd444kjahHSuSB7FkJbKrX","deploymentId":"dpl_DMQXxPZd444kjahHSuSB7FkJbKrX","dynamics":[],"chunks":[]}
