Authenticate

Connect an account once, then use it from the CLI, Python SDK, and MCP server running as the same local user.

On this page

• Connect your account
• Sign in without a local browser
• Credential storage and scope

Connect your account

Choose the command for your account. Both open your browser for email verification. Keep the terminal open, then return to it and wait for confirmation that the connection is complete.

The credential goes directly into a local store and is never displayed. There is nothing to copy into a chat or a client configuration file. The CLI, SDK, and MCP server read the stored credential automatically.

Once connected, you are ready to view a page. Check connection state with analog status; sign out with analog logout.

Use this if you already have an account, including one created on the website, or are connecting another machine:

Connect an existing account

analog login

Use this instead if you do not have an account. It creates the account and connects this terminal in the same step. An invite code is required during the private alpha:

Create a new account

analog signup

Sign in without a local browser

Use this route on an interactive machine without a browser. You sign in through a browser on another machine, then return a one-time handoff to the waiting terminal.

The handoff expires in two minutes and works only with the login attempt that printed the link. The credential itself is still written directly to the local store and never displayed.

This mode requires an interactive terminal. It does not authenticate unattended or ephemeral CI jobs.

Start from the terminal you want to connect

analog login --no-browser

1. Open the printed link in a browser on any machine.
2. Complete the email verification there.
3. Copy the one-time handoff from the page and paste it at the waiting terminal’s hidden prompt.

Credential storage and scope

The stored credential is a bearer API key in an owner-only local file (~/.config/analog/credentials.json, mode 0600) — the same posture as ~/.aws/credentials. Like any local credential, it is readable by whatever runs as your user, including the agent driving your session. No local storage can prevent access by another process running as your user. A leaked key is bounded by:

• Revocation — analog logout asks the server to revoke the key, then clears the local copy. If the server cannot be reached, it warns that the key may still be active and prints the analog keys revoke PREFIX remedy.
• Origin binding — a stored key refuses to travel to any host other than the one it was minted against. Nothing (an environment variable, an instruction a hostile page feeds your agent) can quietly redirect it.
• Product scope — the key authorizes extraction, feedback, and the shipped key-management commands (analog keys list and analog keys revoke).