Authentication
Account sessions and credentials for your agents.
Email and Google
Email sign-in uses a one-use link that expires within 15 minutes. The message shows its lifetime. Opening a link does not sign you in; choose Continue. If you open it in another browser, confirm the email address that received the link. Google signs in through the backend, which verifies that Google is authoritative for the verified address.
API keys
Create a key in API keys, give it a name and choose its expiry. Copy it before dismissing the one-time display. Keys are stored only as hashes. Revoking a key invalidates it immediately; expired keys cannot authenticate. Keys are account-scoped.
Sessions
The account uses a Secure, HttpOnly, SameSite=Lax cookie, short-lived signed access tokens and revocable server-side login records. Sign out ends the current login; Settings can sign out every login. Credentials are never saved in local browser storage.
Client authorization
CLI device approval and remote MCP OAuth consent have separate browser surfaces. They remain inactive until the actual client authorization service is wired. Browser cookies are not MCP credentials.