Why there is no alternate login path

An account can only be signed in to tCode through the normal device-code flow described above; there is no alternate way to authenticate tCode itself using a console.artfical.com API key in place of a real interactive login.

The two systems, interactive account login and programmatic API keys, are kept deliberately separate rather than interchangeable.

This means a key meant for a script you wrote is never something that could also be used to sign in as you interactively, which keeps a leaked API key from ever becoming a path into your actual interactive session.

It also means the reverse is protected too: your interactive tCode session cannot be extracted from a machine and turned into a reusable API key for a program, since the device-code login flow does not produce anything with that shape in the first place.

This separation is one of the reasons a compromised script using a console.artfical.com key is a contained problem, revoke that one key, rather than a reason to worry about your broader account login being affected by it.