---
title: Get access
description: "How accounts, dashboard sign-in, CLI tokens, and headless agent access relate to each other."
---

Access is per person, then reusable by that person's tools.

## Account creation

**The admin** creates your account in the dashboard (`Admin` → `Users` → create): an email, a username (3 to 32 character lowercase slug, becomes your deployment subdomain), and a temporary password. The admin sends you those plus your organization's control-plane URL (for example, `https://control.example.com`).

## Signing in, once, with a browser

1. **Sign in to the dashboard**

    Visit `https://dashboard.sproutboat.com` and sign in with the email and password the admin gave you.

2. **Run the device-code login**

    <CodeGroup>

    ```sh Bun
    bunx sproutboat login --api-url https://control.example.com
    ```

    ```sh npm
    npx sproutboat login --api-url https://control.example.com
    ```

    </CodeGroup>

    It prints a URL and a short code.

3. **Approve the device**

    Open the printed URL in the browser tab where you are signed in and approve it.

The CLI writes a long-lived token to `~/.config/sproutboat/credentials.json` under the endpoint URL. That token is what every later command uses.

## Headless / agent access

Copy the token out of `credentials.json` and pass it as an environment variable. No `login` call, no browser:

<CodeGroup>

```sh Bun
export SPROUTBOAT_API_URL=https://control.example.com
export SPROUTBOAT_TOKEN=sproutboat_SK...
bunx sproutboat deploy
```

```sh npm
export SPROUTBOAT_API_URL=https://control.example.com
export SPROUTBOAT_TOKEN=sproutboat_SK...
npx sproutboat deploy
```

</CodeGroup>

:::note
To revoke a token, use the dashboard (`Settings` → CLI credentials). A CLI token cannot manage other credentials.
:::