Authentication

Aevrin separates browser sessions, CLI credentials, and manually created automation keys. All belong to the same account, but their usage remains attributable.

Dashboard sign-in

Use email and password, Google, or GitHub on the sign-in page. Email verification and password-reset codes are six digits. The browser session is managed by Supabase Auth and sent to the API as a bearer token; it is never copied into CLI configuration.

CLI device login

aevrin login

The terminal prints a one-time code, opens the Aevrin approval page, and polls until you approve it. No account password is entered in the terminal. The resulting key is stored in ~/.aevrin/credentials. Run aevrin logout to remove it.

API keys for automation

Open Dashboard → API keys, create a named key, and copy it immediately; plaintext is shown once. Store it in the CI provider's secret manager and expose it as AEVRIN_API_KEY only for the scan process. Revoke unused keys from the same page. Never commit keys to configuration or a shared shell profile.

The same key authenticates Aevrin MCP

Aevrin MCP takes any key this account owns, as Authorization: Bearer aevrin_.... There is no separate Aevrin MCP key and no OAuth flow. The setup the docs recommend keeps the key out of your agent's configuration file by letting aevrin mcp-header supply it per connection; a key pasted into a configuration file should be one created just for that, so it can be revoked without logging the CLI out.