Skip to content
Analog Docs

Authenticate

New to Analog? One command creates the account and connects the terminal it ran in, in the same step (invite code required during the private alpha):

Terminal window
analog signup

Already have an account, or connecting another machine?

Terminal window
analog login

Either way your browser opens to confirm. The minted credential lands directly in a local store — it is never displayed, so there is nothing to copy-paste into a chat or a config file. Subsequent SDK, CLI, and MCP usage picks it up automatically. Sign out any time with analog logout; check state with analog status.

On an interactive machine without a browser:

Terminal window
analog login --no-browser

Open the printed link in a browser on any machine and complete the email verification there. The page gives you a one-time handoff to paste at the terminal’s hidden prompt. The handoff expires in two minutes and works only with the login attempt that printed the link; the credential itself is still written directly to the local store and never displayed.

This mode requires an interactive terminal. It does not authenticate unattended or ephemeral CI jobs.

Credential storage and scope

Section titled “Credential storage and scope”

The stored credential is a bearer API key in an owner-only local file (~/.config/analog/credentials.json, mode 0600) — the same posture as ~/.aws/credentials. Like any local credential, it is readable by whatever runs as your user, including the agent driving your session. No local storage can prevent access by another process running as your user. A leaked key is bounded by:

  • Revocation — analog logout asks the server to revoke the key, then clears the local copy. If the server cannot be reached, it warns that the key may still be active and prints the analog keys revoke PREFIX remedy.
  • Origin binding — a stored key refuses to travel to any host other than the one it was minted against. Nothing (an environment variable, an instruction a hostile page feeds your agent) can quietly redirect it.
  • Product scope — the key authorizes extraction, feedback, and the shipped key-management commands (analog keys list and analog keys revoke).