# Authenticate

Source: https://getanalog.io/docs/authenticate/

Sign in once; the SDK and MCP server pick the credential up automatically.

Connect an account once, then use it from the CLI, Python SDK, and
MCP server running as the same local user.

<details class="reference-index">
<summary>On this page</summary>

- [Connect your account](https://getanalog.io/docs/authenticate/#connect-your-account)
- [Sign in without a local browser](https://getanalog.io/docs/authenticate/#sign-in-without-a-local-browser)
- [Credential storage and scope](https://getanalog.io/docs/authenticate/#credential-storage-and-scope)

</details>



## Connect your account

Choose the command for your account. Both open your browser for email
verification. Keep the terminal open, then return to it and wait for
confirmation that the connection is complete.

The credential goes directly into a local store and is never displayed.
There is nothing to copy into a chat or a client configuration file.
The CLI, SDK, and MCP server read the stored credential automatically.

Once connected, you are ready to [view a page](https://getanalog.io/docs/extract/).
Check connection state with `analog status`; sign out with `analog logout`.



### Connect an existing account

Use this if you already have an account, including one created on the
website, or are connecting another machine:

<!-- BEGIN GENERATED: onboarding existing-user-auth -->

```bash example=runnable scenario=onboarding-existing-user-auth-default
analog login
```
<!-- END GENERATED: onboarding existing-user-auth -->

### Create a new account

Use this instead if you do not have an account. It creates the account
and connects this terminal in the same step. An invite code is required
during the private alpha:

<!-- BEGIN GENERATED: onboarding new-user-auth -->

```bash example=runnable scenario=onboarding-new-user-auth-default
analog signup
```
<!-- END GENERATED: onboarding new-user-auth -->





## Sign in without a local browser

Use this route on an interactive machine without a browser. You sign
in through a browser on another machine, then return a one-time handoff
to the waiting terminal.

The handoff expires in two minutes and works only with the login
attempt that printed the link. The credential itself is still written
directly to the local store and never displayed.

This mode requires an interactive terminal. It does not authenticate
unattended or ephemeral CI jobs.



### Start from the terminal you want to connect

<!-- BEGIN GENERATED: onboarding existing-user-auth-browserless -->

```bash example=runnable scenario=onboarding-existing-user-auth-browserless
analog login --no-browser
```
<!-- END GENERATED: onboarding existing-user-auth-browserless -->

1. Open the printed link in a browser on any machine.
2. Complete the email verification there.
3. Copy the one-time handoff from the page and paste it at the waiting
   terminal's hidden prompt.



## Credential storage and scope

The stored credential is a bearer API key in an owner-only local file
(`~/.config/analog/credentials.json`, mode 0600) — the same posture as
`~/.aws/credentials`. Like any local credential, it is readable by
whatever runs as your user, including the agent driving your session.
No local storage can prevent access by another process running as your
user. A leaked key is bounded by:

- **Revocation** — `analog logout` asks the server to revoke the key, then
  clears the local copy. If the server cannot be reached, it warns that the
  key may still be active and prints the `analog keys revoke PREFIX` remedy.
- **Origin binding** — a stored key refuses to travel to any host
  other than the one it was minted against. Nothing (an environment
  variable, an instruction a hostile page feeds your agent) can
  quietly redirect it.
- **Product scope** — the key authorizes extraction, feedback, and the
  shipped key-management commands (`analog keys list` and
  `analog keys revoke`).