Authentication
How people, the CLI, and MCP clients sign in and hold credentials.
How signed-in access works across every surface, and how to keep credentials safe. The Web app supports Google, email code, and configured workspace SSO. The CLI signs in with epismo login: passing an email discovers SSO, otherwise it completes email-code login in the terminal. MCP clients start OAuth from server metadata. For CI and other automation, issue a workspace-scoped token with epismo token create and inject it as EPISMO_TOKEN instead of reusing an interactive login — never type a token into shell history or embed one in a Definition, Record, or error report. Building a custom or MCP client? See OAuth for the OAuth 2.0 and OpenID Connect details.