Skip to content
Analog Docs

Authenticate

New to Analog? One command creates the account and connects the terminal it ran in, in the same step (invite code required during the private alpha):

Terminal window
analog signup

Already have an account, or connecting another machine?

Terminal window
analog login

Either way your browser opens to confirm. The minted credential lands directly in a local store — it is never displayed, so there is nothing to copy-paste into a chat or a config file. Subsequent SDK, CLI, and MCP usage picks it up automatically. Sign out any time with analog logout; check state with analog status.

Credential storage and scope

Section titled “Credential storage and scope”

The stored credential is a bearer API key in an owner-only local file (~/.config/analog/credentials.json, mode 0600) — the same posture as ~/.aws/credentials. Like any local credential, it is readable by whatever runs as your user, including the agent driving your session. No local storage can prevent access by another process running as your user. A leaked key is bounded by:

  • Revocation — analog logout revokes the key server-side.
  • Origin binding — a stored key refuses to travel to any host other than the one it was minted against. Nothing (an environment variable, an instruction a hostile page feeds your agent) can quietly redirect it.
  • Narrow scope — the key authorizes extraction and feedback; it cannot modify your account.