‘Not permitted with a device-provisioned key. Use a dashboard session.’
You might be here because: “This operation is not permitted with a device-provisioned key” · “desktop app won’t let me invite / create a key / change billing” · “403 when using the key the desktop app made” · “why does the app send me to the website for settings” · “can’t disable two factor from the app”
Short answer
The credential the desktop app gets from “Sign in with browser” runs sessions and profiles, but is deliberately barred from account-takeover-style actions: creating/rotating/revoking API keys, two-factor changes, team invites and removals, checkout and the billing portal, webhook changes, provider-key changes, and signing out web sessions. Do those in the web dashboard, signed in as the account owner.
Check first
- Are you doing this from the desktop app, or from a script using the desktop app’s credential? Either gets this 403.
- Signed in to the dashboard in a browser? That is the surface for these actions.
Likely causes and fixes
-
The exact 403: “This operation is not permitted with a device-provisioned key. Use a dashboard session.”. This is policy, not a bug: a phished device credential must not be able to take over or drain the account. Fix: open the dashboard and do the action there.
-
A script using the desktop credential as an API key. Create a real API key in the dashboard (on a plan with API access) and use that. Note a real key is still refused for a few human-only actions (MFA, invites, billing) — those are dashboard-only.
-
Desktop Team view has no invite button. By design; it lists members and links to the dashboard.
If it still fails
If the dashboard also refuses the same action, press Talk to a person in this chat (or open Help) and include: account email, the action, and the exact message from the dashboard — that is a different problem.