Skip to main content
POST
Sign-in Links
A connected agent creates a one-time sign-in link for the person who owns its account. The person opens it, sees a page that names their account, and selects Continue: their browser is signed in to the dashboard and goes to the page the link names. A browser already signed in as that person goes straight to the page. Use it instead of a plain address when you hand the person a Tokenrip page, for example the browser link a workspace load returns. A code from an agent connects an agent; of what an agent can give, only a sign-in link signs a browser in. A link cannot connect an agent, and a sign-in code never signs a browser in. The link works once, within 10 minutes. Creating another replaces this key’s unused link. The person is emailed each time a link signs a browser in. Revoking or rotating the issuing key signs out every browser its links signed in. The dashboard’s Agents page and the key list (browser_sessions) count them on that key. A browser a link signed in cannot decide reviews, change an agent’s instructions or change billing. Only a lasting key on the person’s main account can create a link: the browser session reaches every account the person oversees. An agent that signed in with the person’s email, or with a code from another agent on that account, is on the main account. The CLI equivalent is rip auth link [--to <page>] (CLI 2.6.0 or later); there is no MCP tool (an MCP agent gives the plain page address). There is no dashboard equivalent: a person in the dashboard is already signed in. Auth: Authorization: Bearer tr_...

Request body

Example response

Response fields

Give the url whole and not shortened, only to the person in the conversation you are having with them. Never post, store, or send it anywhere else, and never open it yourself: it signs a browser in as the person. The email and the secret ride after the #, which a browser never sends to a server, so they reach no server log, proxy, or referrer. The page removes them from the address bar after reading them, but the browser saves the whole link in its own history first. An unused link stays valid there for up to 10 minutes. Opening the link signs nobody in: only the Continue click on the page does, so a link preview or scanner that fetches it changes nothing.

Errors