> Call the `diagnose` tool first. Full index: /llms.txt. Errors: /reference/problems.

# Sign in

```bash
talotrace login          # opens your browser; tunnels only
talotrace login --tools  # also lets your agent start runs and read evidence
talotrace status         # who you are signed in as
talotrace logout         # revoke and forget this sign-in
```

## Two levels of sign-in

| Command                   | What it allows                                                                                           |
| ------------------------- | -------------------------------------------------------------------------------------------------------- |
| `talotrace login`         | Serve your local ports to TaloTrace runs. Nothing else.                                                  |
| `talotrace login --tools` | The above, and let this computer start runs and read their evidence. Your coding agent needs this level. |

A tool that needs the wider level answers `INSUFFICIENT_SCOPE`. Sign in with `--tools` yourself, or let your agent run it after you say yes. An agent never signs in wider on its own, and a non-interactive session never counts as consent.

## Where it is kept

The sign-in lives in your operating system's keychain and is shared by the CLI and every MCP process. If the keychain does not answer, `login` refuses. Use a [project API key](/api-keys) instead.

On a computer with no browser, `talotrace login --no-browser` prints the sign-in address instead of opening it.

## Sign out

`talotrace logout` revokes the sign-in on this computer. `talotrace logout --all-scopes` ends every sign-in of this server, not just the active one.

A session that a sign-in opened is visible only to that sign-in. A run started with an API key cannot use a tunnel opened by your browser sign-in, and the other way round. The refusal says which one owns the tunnel.