> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heymcp.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# heymcp login

> Sign in with GitHub. Opens your browser once.

```bash theme={null}
heymcp login
```

Prints a code, opens your browser, and waits. Approve it and the CLI is signed
in. If you don't have a HeyMCP account, this creates one.

Sign-in is **GitHub only** — there is no password to set or leak.

## How it works

It's an [RFC 8628 device flow](https://datatracker.ietf.org/doc/html/rfc8628),
the same pattern `gh auth login` and smart TVs use:

<Steps>
  <Step title="The CLI asks for a code">
    You get a short user code and a URL.
  </Step>

  <Step title="Your browser opens to /activate">
    Pre-filled with the code. On a headless box the browser won't open and the
    CLI just prints the URL for you to visit elsewhere.
  </Step>

  <Step title="You approve">
    Sign in with GitHub if you aren't already, then approve the device.
  </Step>

  <Step title="The CLI receives a token">
    Stored at `~/.config/heymcp/config.json` with mode `0600`.
  </Step>
</Steps>

The token is long-lived and stored hashed server-side. It is shown once and
never again.

## In CI

Don't run `heymcp login` in CI. Set the token directly:

```bash theme={null}
export HEYMCP_TOKEN=hm_live_...
heymcp probe localhost:8000
```

Environment always wins over the config file.

<Tip>
  Use a token you can roll independently, and roll it from your profile page if a
  build log ever prints it.
</Tip>

## heymcp logout

```bash theme={null}
heymcp logout
```

Revokes the token server-side **and** deletes it locally.

Deleting `~/.config/heymcp/config.json` by hand only does the second half — the
token stays valid until you roll it from your profile page. Prefer `logout`.

## Troubleshooting

<AccordionGroup>
  <Accordion title="The browser didn't open">
    Expected on a headless machine. The CLI prints the URL; visit it from
    anywhere.
  </Accordion>

  <Accordion title="The code expired">
    Device codes are short-lived. Run `heymcp login` again.
  </Accordion>

  <Accordion title="Signed in as the wrong account">
    `heymcp logout`, then `heymcp login`. Check with
    [`heymcp whoami`](/cli/whoami).
  </Accordion>
</AccordionGroup>