Skip to main content
Prints a code, opens your browser, and waits. Approve it and the CLI is signed in. If you don’t have a HeyMCP account, this creates one. Sign-in is GitHub only — there is no password to set or leak.

​
How it works

It’s an RFC 8628 device flow, the same pattern gh auth login and smart TVs use:
1

The CLI asks for a code

You get a short user code and a URL.
2

Your browser opens to /activate

Pre-filled with the code. On a headless box the browser won’t open and the CLI just prints the URL for you to visit elsewhere.
3

You approve

Sign in with GitHub if you aren’t already, then approve the device.
4

The CLI receives a token

Stored at ~/.config/heymcp/config.json with mode 0600.
The token is long-lived and stored hashed server-side. It is shown once and never again.

​
In CI

Don’t run heymcp login in CI. Set the token directly:
Environment always wins over the config file.
Use a token you can roll independently, and roll it from your profile page if a build log ever prints it.

​
heymcp logout

Revokes the token server-side and deletes it locally. Deleting ~/.config/heymcp/config.json by hand only does the second half — the token stays valid until you roll it from your profile page. Prefer logout.

​
Troubleshooting

Expected on a headless machine. The CLI prints the URL; visit it from anywhere.
Device codes are short-lived. Run heymcp login again.
heymcp logout, then heymcp login. Check with heymcp whoami.