> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heymcp.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Signing in

> GitHub OAuth, the CLI device flow, and your token.

## Your account

Sign-in is **GitHub only**. There is no password to set, forget or leak, and no
anonymous tunnels — which is deliberate: it's the abuse stance, and it fits who
this is for.

Signing in for the first time creates your account and mints your
[reserved slug](/concepts/urls-and-paths#your-url).

## Signing the CLI in

```bash theme={null}
heymcp login
```

An [RFC 8628 device flow](https://datatracker.ietf.org/doc/html/rfc8628) — the
same pattern `gh auth login` uses. The CLI prints a code, your browser opens to
approve it, and the CLI receives a token. See [`heymcp login`](/cli/login).

## Your CLI token

|                       |                                                              |
| --------------------- | ------------------------------------------------------------ |
| Format                | `hm_live_…`                                                  |
| Stored locally at     | `~/.config/heymcp/config.json`, mode `0600`                  |
| Stored server-side as | A SHA-256 hash — the plaintext is shown once and never again |
| Displayed as          | `hm_live_••••••••••••4k2x`                                   |
| Overridden by         | `HEYMCP_TOKEN` in the environment                            |

### Rolling it

From your **profile** page. Rolling revokes every existing token immediately and
issues one new one, so:

* Any machine or CI job using the old token needs the new one.
* **Every open tunnel dies.** You'll need to re-run `heymcp share`.

Do this if a token has ever appeared in a build log, a screen share, or a
committed file.

### Revoking it on one machine

```bash theme={null}
heymcp logout
```

Revokes server-side and deletes locally. Deleting the config file by hand only
does the second half.

## Notification preferences

Two toggles on your profile, under *Email me when*:

* **A tool call fails** — on by default
* **A new client connects** — off by default

<Note>
  These record your preference; email delivery is not switched on yet, so
  changing them has no visible effect today.
</Note>

## Privacy

A session belongs to exactly one account. There is no team model, so nobody else
can subscribe to your timeline or read your events.

What HeyMCP stores, and for how long, is covered in
[What is exposed](/security/what-is-exposed#what-heymcp-sees).