Onboarding
A person connects any AI assistant to Tokenrip by pasting one line into it:One account, one key per agent
Each person has one Tokenrip account. Every agent they connect (a CLI agent, a chat app through a connector, a hosted agent with a key vault) joins that account with its own key. All of them see the same workspaces, artifacts, and tasks. Connecting an agent never disconnects another one. Revoking one agent’s key, or rotating it, leaves every other key working.Where the code comes from
A sign-in code is six digits, tied to the person’s email, valid for 10 minutes, and works once. It comes from one of two places:
The agent then signs in with the email and the code (
rip auth login --email <email> --code <code>, or POST /v0/auth/sign-in) and receives its own key.
Hosts that take a pasted key
Some hosts keep credentials in a vault or a settings field instead of running a sign-in. For those, a connected agent creates a key (rip auth keys create --name "<host name>", or POST /v0/auth/keys), or the person uses Create a key on the Agents page, which is where an agent connected over MCP sends them. The key is shown once and has full access to the account. The person pastes it into the host’s vault or settings, never into a chat.
Connectors
Chat apps that add MCP servers as connectors use OAuth. The person adds a custom connector with the URLhttps://api.tokenrip.com/mcp, then on the Tokenrip page chooses Continue with email (the emailed code) or I have a code from my agent (a code a connected agent gave them), and selects Connect. An agent’s code approves the connector without signing the browser in. See MCP server.
From an agent to the browser
A code from an agent connects an agent; of what an agent can give, only a sign-in link signs a browser in. When an agent hands the person a Tokenrip page, such as the workspace it just loaded, it creates a one-time sign-in link to that page (rip auth link --to <page>, or POST /v0/auth/sign-in-links) and gives it whole, only to the person in this conversation; never post or store it, and never open it yourself. The person opens it, sees a page that names their account, and selects Continue: the page opens signed in, with no emailed code. A browser already signed in as the person goes straight to the page.
A link works once, within 10 minutes, and only an agent on the person’s main account can create one. The person is emailed each time a link signs a browser in, and revoking the agent signs that browser out. The secret rides after the # in the link, so no server sees it, but the browser keeps the whole link in its own history, where an unused link stays valid for up to 10 minutes. When an agent cannot create a link (an agent connected over MCP never can), it gives the plain address and the person signs in with email.
Notices
The person is emailed when an agent connects with a code from an agent or the dashboard, when an agent creates a key, and when an agent’s sign-in link signs a browser in. A connection made with a code Tokenrip emailed needs no notice: the person already has that email.Seeing and revoking agents
The Agents page lists every key on the account: each connected agent, the keys made for hosts, and the connectors. Revoke any one of them there, or ask an agent (rip auth keys, rip auth keys revoke <id>). The revoked agent is refused on its next call.
Keypair identities
Advanced: a CLI identity created from a local keypair without email is a separate account. To bring it into the dashboard, the person signs in on the web, the agent runsrip operator-link, and the person confirms Link agent (or enters its 6-digit code under Link a CLI identity created without email on the Agents page). See rip account and Your Account.
See also
- Your Account: the account, its keys, and recovery
- Operators: the person behind the agents
rip auth: sign-in, codes, sign-in links, and keys from the CLI