Skip to main content
The Stack0 Cloud dashboard mints a one-time 8-character code. The code signs a coding agent into your account, installs the Pylon skill, and gives the agent an opening prompt. It works with any agent that runs shell commands from a markdown prompt (Claude Code, OpenAI Codex CLI, OpenCode, Cursor, Aider, grok build). You paste the code once and type nothing.

​
Use it

  1. Sign in at www.pylonsync.com.
  2. Open an organization. The first card on the page is Hand off to your coding agent.
  3. Click Generate prompt. The dialog shows a short code (e.g. ABCD-1234) inside a paste-ready blurb.
  4. Click Copy prompt, paste into your coding agent, press return.
The agent will:
  • install the Pylon CLI (curl -fsSL https://www.pylonsync.com/install.sh | bash)
  • sign in with pylon login --code ABCD-1234
  • load https://www.pylonsync.com/pylon-skill.md into wherever it persists project rules (~/.claude/skills/pylon/SKILL.md for Claude Code, .cursor/rules/pylon.mdc for Cursor, CONVENTIONS.md for Aider, etc.)
  • run pylon projects list + pylon status so it knows the starting state
  • ask you what you want to build

​
Short-code security

The dashboard mints a real pk.* Pylon API key first (the same kind you create manually in /dashboard/account/cli-tokens). It then stores the key on the server behind the short code. The prompt you paste into the agent contains only the code. The token never appears in the chat history, the model provider’s logs, or any analytics that records the prompt. When the agent runs pylon login --code ABCD-1234, the CLI calls /api/fn/exchangeCliAuthCode on the cloud, which:
  • atomically sets the stored token to null and stamps consumedAt
  • returns the token to the CLI in one round-trip
  • the CLI writes it to ~/.config/pylon/credentials.json (mode 0600)
If nobody redeems the code, the token stays inert in the database for 5 minutes and then becomes unreachable. A revoke from /dashboard/account/cli-tokens removes it.

​
Properties

  • Single-use. A second exchangeCliAuthCode call with the same code returns CODE_USED.
  • Short TTL. Five minutes. Past that the code returns CODE_EXPIRED.
  • High entropy. XXXX-XXXX over a 30-symbol confusable-pruned alphabet gives about 40 bits. The 5-minute window and the per-IP rate limit make a brute-force guess in flight infeasible.
  • Revokeable like any other token. The minted key appears at /dashboard/account/cli-tokens as Coding agent · MMM D. Click trash to end the agent’s session immediately.

​
Working without the dashboard

If you script this and do not want to click through the UI, the --code exchange endpoint is a regular Pylon function. You can write your own pre-mint flow:
Or use the regular pylon login paste flow when you already have a token. The code-exchange path is an agent-onboarding convenience.

​
What the prompt contains

The full prompt the dashboard generates: