# Sign-in and access

**Coding agents registering for Firedrill: start at
[app.firedrill.run/auth.md](https://app.firedrill.run/auth.md).** That page is
served by the Firedrill service and carries the current self-registration
instructions, so follow it rather than this summary when they differ.

Firedrill has three separate ways in. Each needs the person's approval in their
browser, and none of them is anonymous. Don't substitute one flow's steps for
another's.

## 1. Agent registration (service_auth)

For a coding agent that needs remote MCP access for a person who already has a
Firedrill workspace. The steps live at
[app.firedrill.run/auth.md](https://app.firedrill.run/auth.md).

- The person claims the registration on a sign-in page and reads a code back to
  the agent. The agent never sees their password.
- The agent holds the resulting registration credentials and short-lived access
  tokens only in its private credential store (for example the OS keychain).
  Never print them or put them in a log, prompt, URL or project file.
- Bind access tokens to the exact resource `https://mcp.firedrill.run`, with no
  path. Firedrill MCP rejects tokens issued for any other audience.
- What the agent can do is limited by the person's current workspace
  permissions. Registration does not approve spending or billing.

## 2. Remote MCP sign-in in your MCP client

Add `https://mcp.firedrill.run` to your MCP client as a remote HTTP server. The
client opens a browser window where the person signs in and chooses the
organization; the client stores its own tokens. Setup commands for each client
are in the [connection guide](https://firedrill.run/agents.md).

MCP access manages cloud resources and reads reports. It cannot read local files
or start local processes. No local package is needed for MCP.

## 3. CLI sign-in (device code)

For a terminal, and for a new account.

```sh
npx firedrill-run init
```

`init` signs in with a device code. A coding agent should start it once with
`npx firedrill-run init --json --no-browser`, give the printed link and code to
the person, and keep that command running until they approve. Keep one sign-in
pending at a time; never run `init` again while it is pending.

`npx firedrill-run` does not install a global `firedrill` command, so later
commands keep the prefix
(`npx firedrill-run status`). The shorter `firedrill` command below works only
after the optional global install, `npm install -g firedrill-run`.

- Credentials are stored in the OS credential store. Use `--session-only` to
  keep them in memory for the current session. Keep that `init` running and
  pass `--session-only` on later commands too (`npx firedrill-run status
  --session-only --json`).
- `firedrill status` shows the account, workspace and credential mode.
- `firedrill logout` removes stored credentials.
- `firedrill mcp --agent codex|claude|other` prints the MCP setup for a client.

## Create an account

Sign up in the [web app](https://app.firedrill.run/signin?screen_hint=sign-up),
or let the CLI start sign-up with `firedrill init`. New accounts need no payment
card and start on the Free plan with 500 credits a month.

A first workspace needs the person's approval of its name, the terms and the
privacy policy. `firedrill workspace create` shows all three and the command to
run once they approve. An agent must never accept them on the person's behalf.

## What signing in does not approve

Registration, CLI and MCP sign-ins are separate. None of them approves spending
credits, running local commands or using a real account. Each of those is shown
to the person and approved when the plan is reviewed.

Never put a token, device code, registration credential or password in a URL, a
project file, a prompt or a log.

If sign-in fails, [contact us](https://firedrill.run/contact).

[Agent registration](https://app.firedrill.run/auth.md) ·
[Agent setup guide](https://firedrill.run/agent-setup.md) ·
[Connect a coding agent](https://firedrill.run/agents.md) ·
[Run your agent](https://firedrill.run/run-your-agent.md)