# ai.newnal.illi.account.parent.signIn

> Published by [illi-service.newnal.id](https://lexicon.garden/identity/did:plc:uztm7bi2ce42dez3uu3qafro)

✓ This is the authoritative definition for this NSID.

## Links

- [View on Lexicon Garden](https://lexicon.garden/lexicon/did:plc:uztm7bi2ce42dez3uu3qafro/ai.newnal.illi.account.parent.signIn)
- [Documentation](https://lexicon.garden/lexicon/did:plc:uztm7bi2ce42dez3uu3qafro/ai.newnal.illi.account.parent.signIn/docs)
- [Examples](https://lexicon.garden/lexicon/did:plc:uztm7bi2ce42dez3uu3qafro/ai.newnal.illi.account.parent.signIn/examples)

## Definitions

### `ai.newnal.illi.account.parent.signIn`

**Type**: `procedure`

Sign a parent account in to ILLI from the device without a screen: the device presents the parent's scoped deviceApp app password (which it keeps) and its attestation; the Service Agent Node opens the delegated session, joins the account to the service sphere on first use and returns the device-app session. Used at first connection and at every re-login.

#### Input

**Encoding**: `application/json`

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `appPassword` | `string` | Yes |  |
| `attestation` | `string` | Yes | Device attestation: production = an Android key-attestation statement whose certificate chain roots at Newnal's RKP CA and whose challenge is the nonce from account.getAttestationNonce, as a compact JWS with the x5c certificate chain; PoC = mock:device:<secret>. |
| `deviceId` | `string` | Yes |  |
| `did` | `string` (did) | Yes |  |
| `slot` | `integer` | No |  |

#### Output

**Encoding**: `application/json`

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `deviceStatus` | `string` | No |  |
| `did` | `string` (did) | Yes |  |
| `expiresAt` | `string` (datetime) | No |  |
| `handle` | `string` (handle) | Yes |  |
| `token` | `string` | No | The device-app session token for native clients; web clients receive it as the illi_session cookie. |

#### Errors

- **InvalidAppPassword**
- **WrongScope**
- **InvalidAttestation**
- **DeviceRevoked**
- **ParentLimitReached**
- **ParentAlreadyLinked**
- **RateLimitExceeded**

## Raw Schema

```json
{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "Sign a parent account in to ILLI from the device without a screen: the device presents the parent's scoped deviceApp app password (which it keeps) and its attestation; the Service Agent Node opens the delegated session, joins the account to the service sphere on first use and returns the device-app session. Used at first connection and at every re-login.",
      "errors": [
        {
          "name": "InvalidAppPassword"
        },
        {
          "name": "WrongScope"
        },
        {
          "name": "InvalidAttestation"
        },
        {
          "name": "DeviceRevoked"
        },
        {
          "name": "ParentLimitReached"
        },
        {
          "name": "ParentAlreadyLinked"
        },
        {
          "name": "RateLimitExceeded"
        }
      ],
      "input": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "appPassword": {
              "type": "string"
            },
            "attestation": {
              "description": "Device attestation: production = an Android key-attestation statement whose certificate chain roots at Newnal's RKP CA and whose challenge is the nonce from account.getAttestationNonce, as a compact JWS with the x5c certificate chain; PoC = mock:device:<secret>.",
              "type": "string"
            },
            "deviceId": {
              "maxLength": 64,
              "type": "string"
            },
            "did": {
              "format": "did",
              "type": "string"
            },
            "slot": {
              "maximum": 2,
              "minimum": 1,
              "type": "integer"
            }
          },
          "required": [
            "deviceId",
            "did",
            "appPassword",
            "attestation"
          ],
          "type": "object"
        }
      },
      "output": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "deviceStatus": {
              "knownValues": [
                "registered",
                "awaitingLink",
                "active",
                "unlinked",
                "retired"
              ],
              "type": "string"
            },
            "did": {
              "format": "did",
              "type": "string"
            },
            "expiresAt": {
              "format": "datetime",
              "type": "string"
            },
            "handle": {
              "format": "handle",
              "type": "string"
            },
            "token": {
              "description": "The device-app session token for native clients; web clients receive it as the illi_session cookie.",
              "type": "string"
            }
          },
          "required": [
            "did",
            "handle"
          ],
          "type": "object"
        }
      },
      "type": "procedure"
    }
  },
  "id": "ai.newnal.illi.account.parent.signIn",
  "lexicon": 1
}
```