| Task | Account required? |
|---|
| Download a kit or read the docs | No. |
|---|
| Develop and test on your computer | No. |
|---|
| Upload and host a game | Yes. |
|---|
| Update an existing hosted project | Yes, with permission to access that project. |
|---|
Open Sign in and choose the sign-in or sign-up option offered there. Complete identity verification and any required terms yourself. For access problems, contact support.
After signing in, use Upload game to publish a new game. For an existing project, open it from your dashboard. Project access is checked by the server on each operation.
If you use a coding agent, keep account verification in your own browser. Do not put passwords, tokens, or session cookies into project files, prompts, or build logs.
pnpm dlx @spawnkit/cli login --site https://spawnkit.cloud
The CLI opens a browser for sign-in and access review. Complete the browser flow on the same computer. The local callback is http://127.0.0.1:43819/callback, and each authorization attempt expires after five minutes.
If the CLI cannot open a browser, --no-browser prints the sign-in link. It still needs the callback on the CLI's computer; it is not a remote device authorization flow. Start a fresh login attempt if the previous one expired.
Use this flow when your agent runs on another computer or in a hosted environment. First, create an account and create a project in the dashboard. Copy its ID from Settings → General. The account owner must approve access in their own browser; the agent must not operate the approval page.
pnpm dlx @spawnkit/cli login --remote --email YOU@example.com --project YOUR_PROJECT_ID
pnpm dlx @spawnkit/cli link --project YOUR_PROJECT_ID
pnpm dlx @spawnkit/cli deploy --env production --dry-run --json
pnpm dlx @spawnkit/cli deploy --env production --yes --json
The CLI prints a link and a six-digit code. Open the link, sign in with the verified email used in the request, review the project and permissions, enter the code, and approve. The request expires after ten minutes. Approving grants one hour of access to that project, including its sandbox and production environments. The agent cannot create or delete projects, access another project, change account settings, or manage secrets.
Access tokens last up to 15 minutes. The CLI renews them when starting another command while the one-hour grant remains valid. If a long-running command reaches expiry, authorize again and resume with the saved deployment ID; do not submit the same deployment twice. Use Agent access or pnpm dlx @spawnkit/cli logout to revoke the grant early.
| Problem | Next step |
|---|
| Email does not match | Sign in with a verified email on the account that owns the project, or start a new request with the correct email. |
|---|
| Code expired or five attempts failed | Start a fresh remote login request. Each code can approve only its own request. |
|---|
| Operation is forbidden | Check the project ID and granted scope. Remote access cannot list all projects or change account settings. |
|---|
| Access expired or was revoked | Start remote login again. Ask the owner to review the new request. |
|---|
| Agent cannot reach the service | Use a runtime with outbound HTTPS access. Keep credentials out of prompts and project files. |
|---|
SpawnKit supports the WorkOS-authored auth.md service_auth flow for existing projects. Read the protected-resource metadata and authorization-server metadata for endpoint and scope discovery. Anonymous access and provider identity assertions are not supported. Account creation and consent remain browser operations.
| Scope | Permission on the approved project |
|---|
projects:read | Read project configuration, release history, deployment status, and build logs. |
|---|
deployments:write | Upload source, deploy, promote, and roll back releases. Requires projects:read. |
|---|
curl https://api.spawnkit.cloud/agent/identity \
-H 'Content-Type: application/json' \
-d '{"type":"service_auth","login_hint":"YOU@example.com","project_id":"YOUR_PROJECT_ID","scope":"projects:read deployments:write"}'
The response includes registration_id, claim_token, and a claim object with verification_uri, user_code, expires_in, and interval. Show the link and code to the owner. Keep claim_token private. Poll the advertised token endpoint using a form-encoded POST with grant_type=urn:workos:agent-auth:grant-type:claim and claim_token. Wait at least interval seconds between requests. Continue on authorization_pending; add five seconds to the interval on slow_down. Stop on access_denied or expired_token.
After approval, the response contains a Bearer access_token, expires_in, scope, identity_assertion, and assertion_expires. Send the access token in the Authorization header to https://spawnkit.cloud/api/platform/v1. To renew it within the grant's lifetime, POST grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer, assertion=<identity_assertion>, and resource=https://spawnkit.cloud/api/platform/v1 to the token endpoint. No refresh token is issued. Store both credentials securely; never return them in agent conversation output.
Revoke an individual access token with a form-encoded POST to https://api.spawnkit.cloud/oauth2/revoke containing token=<access_token>&token_type_hint=access_token. The identity assertion remains valid. To end the entire grant, use SpawnKit's token_type_hint=identity_assertion extension with the identity assertion as token; this invalidates every token and prevents renewal. Revocation returns 200 for unknown or already-revoked credentials. The owner can also revoke grants at Agent access.
Registration and polling are rate-limited. Respect slow_down and stop repeated attempts on HTTP 429. API authentication failures include a WWW-Authenticate discovery hint. The public OpenAPI file covers kit discovery and downloads; this section documents the remote authorization contract.
pnpm dlx @spawnkit/cli auth status --json
The result is signed-in or sign-in-required. This checks locally stored credentials and never returns the token. It does not contact the server, so a locally valid credential can still be rejected by a project operation.
For expired or unreadable local credentials, reconnect:
pnpm dlx @spawnkit/cli logout
pnpm dlx @spawnkit/cli login --site https://spawnkit.cloud
If sign-in works but a project operation is denied, check that you selected the correct project and that your account has access to it.
For remote-agent sessions, pnpm dlx @spawnkit/cli logout revokes the grant on the server before removing local credentials. If revocation fails, it keeps the credentials so you can retry. For local browser OAuth sessions, logout removes the local credential only. Browser sign-in is managed separately through its account controls.
Starter kits and single-player hosting are currently free. Check hosting plans and availability for current limits. Upcoming services are not available for provisioning until they are marked available.
For an account or deployment issue, use support. Include the relevant project or deployment ID and the error message, with any credentials removed.