Skip to main content
You are an agent. This page says how to sign the person in. You never sign in, sign up or approve for them: they do that in their browser, and you wait. Accounts are created only by the person, on the sign-in page.

​
Claude Code: the CLI login

What happens:
  1. The CLI asks OpenScaffold for a one-time login and prints a link (https://app.openscaffold.ai/cli/login?code=XXXX-XXXX) and its code. It tries to open the link in a browser. Over SSH, on Linux without a display, or with OPENSCAFFOLD_NO_BROWSER=1, it doesn’t; it says so.
  2. Tell the person: “Open <link>. Sign in (or sign up) if asked, check the page shows the code XXXX-XXXX, and click Approve.” The link works on any device: their laptop or phone is fine when you’re on a remote machine.
  3. The CLI checks every 2 seconds until they click, for up to 10 minutes. It prints a waiting line once a minute. Run it in the background or with a 10-minute timeout so your shell doesn’t kill it.
  4. On Approve it saves the login (~/.config/openscaffold/credentials.json, readable only by the person), adds the MCP server, the session hook and the /os-* commands to Claude Code, and prints a status report. With the openscaffold plugin installed it adds only the hook.
  5. Its last line is one JSON object:
The link works once and expires after 10 minutes. The secret the CLI polls with never appears in the link, so a shared link can’t be used by anyone else.

​
Check it worked

ready: true means done. Otherwise do what next says. Then the person restarts Claude Code (/exit, then claude --continue) so the tools load.

​
Every other client: OAuth

Cursor, Codex, VS Code, the Claude Code plugin and other MCP clients sign in with OAuth. You add the server (see the agent quickstart); the client opens a browser page where the person signs in, picks the one workspace this agent may use and clicks Allow. Only agents running on the person’s machine can be approved. Over SSH in Claude Code, claude mcp login <server> --no-browser prints the sign-in URL instead: the person opens it, approves, and pastes the address the browser lands on back when asked. The CLI login above is simpler there: its link works from any device.

​
What the person can undo

  • CLI: npx @openscaffold/cli logout removes everything login added and revokes the login.
  • Any agent: app.openscaffold.ai → Settings → Connected agents → Disconnect. The agent loses access within a minute.