How to Configure and Use the Devin VSCode Extension

While 84% of developers reported using or planning to use AI coding tools in the 2025 Stack Overflow Developer Survey, a 2026 Kilo.ai report shows that only 29% of developers fully trust agentic output without manual validation [Kilo.ai 2026 Report]. This 55-point trust gap highlights why software engineering teams prefer direct local supervision of AI agent workflows over completely hands-off cloud processes. Rather than delegating tasks blindly to an isolated virtual environment, developers need to monitor directory changes, audit terminal commands, and review codebase alterations in real time. The Devin Sessions VS Code extension connects local development environments to Devin's autonomous VM via service user tokens [Cognition AI VS Code Extension Documentation]. This extension allows you to manage and interact with your Devin sessions directly within your editor, preserving your customized theme, keybindings, and development environment.

Behind the scenes, each Devin session runs within an isolated Linux container provisioned dynamically by Cognition. This virtual machine is equipped with dedicated CPU resources, memory, and full terminal access, allowing the agent to compile code, run tests, and spin up local servers. By running Devin inside your local editor, you eliminate the friction of constant context switching between the browser and your terminal. The extension provides a native sidebar to list active sessions, watch shell output streams, and inspect git diffs. If the autonomous agent makes an incorrect assumption or hits a blocking error, you can immediately intervene via the built-in chat interface. This side-by-side interaction model is particularly valuable for complex refactoring tasks, API upgrades, or debugging sessions that affect dozens of files across a large codebase. It ensures that the agent works as a collaborative coworker under your direct guidance, rather than an untracked process running in isolation.

A common configuration challenge when setting up the Devin Sessions extension is deciding how to provision your API credentials. Most developers are accustomed to personal accounts, which authenticate using standard OAuth browser handshakes or Personal Access Tokens (PATs). While personal authentication is quick to configure for a single developer, it binds the editor integration directly to a human identity. In a collaborative team environment, this setup introduces security and operational vulnerabilities. If you start a long-running coding session that spans several hours and your local login session expires, the agent will lose access to the organization's repositories, causing the task to fail mid-run.

Service users, by contrast, are dedicated programmatic entities managed in your organization settings. They are not tied to any single developer's identity, which means their API tokens remain active regardless of individual employee login status. These service users use Role-Based Access Control (RBAC) to enforce security boundaries, allowing administrators to restrict the agent's repository access to specific staging or test directories. When configuring Devin for VS Code, creating a dedicated service user is the standard approach. This allows engineering leaders to audit agent actions separately from human developer commits, set precise resource limits, and rotate keys without disrupting the team. Security policies can enforce strict secret rotation cycles, replacing the cog_ token every few months. It also ensures that if a developer leaves the organization, their personal account can be deactivated without breaking active agent pipelines or automated cron jobs.

Setting up a secure connection between your local editor and Devin's VM requires configuring the correct permission scopes in your Cognition dashboard. If your service user lacks the necessary authorization, the extension will throw authentication errors when listing or launching coding tasks. Follow these steps to provision credentials:

1. Log in to your Devin organization dashboard at https://app.devin.ai/ and navigate to your account settings.
2. Select the API panel from the sidebar, then navigate to the Service Users tab.
3. Click on the button labeled Provision Service User to initiate the credential creation flow.
4. Name the service user logically, such as vscode-agent-connection, to keep your audit logs clean.
5. In the permissions wizard, assign the necessary scopes. The extension requires the ViewOrgSessions and ManageOrgSessions permissions to monitor and launch agent sessions.
6. Generate the API token and copy the key immediately. The credential starts with the cog_ prefix and is only displayed once during the initial provisioning.
7. Copy your Organization ID from the same panel, which starts with the org- prefix, for use in the extension settings.

After provisioning, VS Code stores these credentials using its built-in Secret Storage API. This delegates the security of the tokens to your operating system's native keychain, such as macOS Keychain or Windows Credential Manager. This local storage prevents plain-text keys from being stored in your project files or settings JSON, mitigating the risk of accidental credential leaks to public repositories. It is highly recommended to audit these permissions periodically, ensuring the service user has only the minimum scopes required for your team's development tasks.

Audit and Manage Your Devin AI VSCode Extension Outputs

Set up a shared Fastio workspace to persist Devin VM code artifacts, track version history, and manage human handoffs with a 14-day free trial.

Start 14-Day Trial

Once you have generated your cog_ API key, the next stage is configuring your editor. Open VS Code and navigate to the extensions marketplace. Search for the official Devin Sessions extension published by Cognition AI and click install. Alternatively, you can run the extension installation command via your terminal.

After the installation completes, click on the Devin icon that appears in the activity bar. The editor will display a configuration prompt requesting your credentials. Enter the cog_ API key and the org- organization ID that you copied from the dashboard. Once authenticated, the panel will display a list of your organization's active and historical sessions. When you select a session, the extension opens a multi-tabbed interactive panel inside your editor. This panel displays a terminal view mirroring the agent's workspace shell, a step-by-step progress tracking tab, and a synchronized browser preview showing any web applications the agent spins up during execution.

While the extension connects your editor directly to Devin's autonomous virtual machine, managing the files and outputs generated by these sessions requires a reliable workspace layer. Developers often choose basic local storage, raw AWS S3 buckets, or general consumer cloud drives like Google Drive. However, these options introduce limitations. Local folders isolate files from other developers. Raw S3 buckets require building custom user interfaces and lack versioning features. Google Drive lacks support for developer toolkits and automated agent access.

To bridge this gap, teams use Fastio to provide a coordinated storage and intelligence layer. Fastio provides shared workspaces where both human developers and autonomous agents collaborate on the same files. When Devin finishes generating code, you can upload the files to a Fastio workspace. Fastio preserves a complete, automatic version history for every file, ensuring that all changes made by the agent remain auditable. This enables your team to compare edits, restore prior versions, and work concurrently without file conflicts.

Managing files is only the first step in an agentic development workflow. Once Devin completes a feature, the output must be reviewed, summarized, and handed over to other team members or clients. Fastio simplifies this transition through its dedicated ownership transfer capability. A developer or agent can set up a workspace, populate it with the required code and build logs, and then transfer the organization to a human using a secure claim link.

For files and deliverables that require structured data review, Fastio offers Metadata Views. Instead of writing custom parsing scripts or OCR rules, you can define the columns you want to extract in natural language. The system automatically builds a schema and populates a filterable spreadsheet with dates, totals, or Boolean values pulled directly from your documents. If you want to explore the details of this structured extraction, read the Fastio Metadata Views page.

Every organization on Fastio runs on a paid subscription model. While creating a user account is free, active workspace operations require a subscription. Fastio offers a 14-day free trial that requires a credit card to get started, ensuring your team has ample time to test integrations. The Starter plan is priced at $29 per month, the Business plan is $99 per month, and the Growth plan is $299 per month. These plans provide the persistent storage, semantic indexing, and audit logs required to run a professional agentic pipeline. These features help you scale agent activities from local prototypes to production-grade integrations, ensuring files remain structured, auditable, and secure.

When configuring the Devin Sessions extension locally, developers occasionally encounter connection errors, permission blocks, or session timeouts. Identifying the root cause requires checking both local editor settings and Cognition API logs.

If the extension fails to save your credentials, the issue is typically related to VS Code's access to your operating system's keychain. On Linux systems, this happens if a keyring service like GNOME Keyring or KWallet is missing. You can resolve this by installing the required keyring library or setting the environment variables DEVIN_API_KEY and DEVIN_ORG_ID in your terminal shell before launching VS Code from the command line. You can also inspect the internal VS Code log files by navigating to the Help menu and selecting Toggle Developer Tools. Inspect the Console tab for any Secret Storage exceptions, which indicate keychain access issues.

If you encounter 403 Forbidden errors when attempting to start a session, double-check your service user scopes. The Devin API requires both the ViewOrgSessions and ManageOrgSessions scopes. If your token was provisioned with only view-level access, the agent VM cannot be initialized from the local IDE panel. To fix this, revoke the active token in your Cognition dashboard, provision a new service user with both scopes enabled, and enter the new cog_ key in VS Code.

Finally, ensure your local firewall or corporate proxy does not block outgoing WebSockets or HTTPS traffic to Cognition's API endpoints. The extension relies on WebSockets to stream terminal outputs and chat messages in real time. If the sidebar displays a constant connecting status, verify that outbound ports are open and that your proxy config is correctly set in your VS Code settings. Checking your local development network settings ensures your IDE maintains a continuous, uninterrupted connection to the remote container VM.