--- title: Sign in and authorize description: Dashies uses OAuth 2.1 with PKCE, so your AI tool signs in through the browser once. There is no token to copy, paste, or rotate. updated: 2026-09-24 tier: free --- The first Dashies tool call your AI makes opens a browser window and asks you to sign in. You do this once per tool. There is no API key to generate and no token to paste anywhere. ## What happens when you first publish Your AI tool drives the whole handshake. You only see the browser step. :::steps ### 1. The tool call returns a 401 Your AI calls a Dashies tool with no credential. The publish service answers `401` with a `WWW-Authenticate` header pointing at its OAuth metadata. ### 2. Your tool registers itself It reads `/.well-known/oauth-authorization-server` and `/.well-known/oauth-protected-resource`, then registers as a client. This is Dynamic Client Registration, and it is why there is nothing for you to configure. ### 3. A browser window opens If you are not signed in, the screen is headed **Connect to Dashies**: click **Continue with Google** or **Continue with Microsoft**. Once you are signed in it is headed **Authorization request**, and it names the tool that is asking, the account it is signed in as, and the address it will redirect back to. In Claude Code the browser does not open by itself: run `/mcp`, select **dashies**, and choose **Authenticate**. ### 4. You choose the workspace it publishes into Under **Publish to**, pick the workspace this tool may publish into. With one workspace it is already selected, and **Allow access** stays unavailable until one is picked. If your account has no workspace yet, the screen says so. Create one at [dashies.ai](https://dashies.ai), which signing up walks you through, then reload this page or retry the tool call. ### 5. You approve, and the browser hands control back Your tool receives an authorization code on a loopback address and exchanges it for an access token. The tool call that started all this now runs. ::: :::warning{title="Check the redirect address before approving"} The consent screen shows the address the tool will be redirected to. A local AI tool redirects to a loopback address (`http://127.0.0.1:` or `http://localhost:`). Dashies flags a redirect that is not a loopback address, because a remote redirect on a locally-run tool is a phishing signal. Click **Deny** if the address is not one you expect. ::: ## One authorization, one workspace The workspace you pick on the consent screen is baked into the grant. A connection authorized to a workspace can act only in that workspace. There is no runtime switch. What a workspace authorization can do: - Publish, update, rename, and delete dashboards in that workspace. They are members-only. - List and read back that workspace's dashboards, and roll them back to earlier versions. - It cannot touch any other workspace. To publish into another workspace, authorize again and pick it. See [Work as a team](/guides/work-as-a-team) for how workspace scope interacts with warehouse connections, which is where this trips people up. ## Signing in with SSO If your company uses SAML single sign-on, sign in at [dashies.ai](https://dashies.ai) first, using **Sign in with SSO** and your work email. Once you have a Dashies session in that browser, the consent screen recognises it and you go straight to the approval step. Your admin has to have configured SAML and verified your email domain before this works. Until then, that domain has no SSO and you sign in with Google instead. ## Staying signed in Access tokens are short-lived, and your tool renews them without involving you. The renewal chain belongs to the authorization rather than to a browser tab, so closing the browser does not end it. You are asked to sign in again only when: - you disconnect the tool in Dashies ([Disconnect a tool](#disconnect-a-tool)), - you explicitly sign out, - a refresh token is detected as reused, which invalidates the chain, or - the sign-in service is unreachable at the moment your tool tries to renew. Nothing is written to a config file that you need to protect. In Claude Code, the access token is stored in the operating system keychain, and the Dashies entry in `~/.claude.json` holds only the connector URL and type. ## Check it worked Ask your AI tool to list your dashboards: > List my Dashies dashboards. A list comes back, and it is empty on a new account. An empty list is a pass: the tool call completing without an auth error is the signal. To confirm what you authorized, open [dashies.ai/app](https://dashies.ai/app): the account menu shows who you are signed in as, and the **MCP** section in Settings shows whether your AI tool is connected. If you picked the wrong workspace, authorize again and pick the right one. ## Disconnect a tool Open Settings in Dashies and choose **MCP**. Every AI tool you have authorized is listed with the date you authorized it and the address it returns to. Press **Disconnect** beside a tool and confirm. The tool loses access, usually within a minute: its next request and its next token renewal are both refused. To use it with Dashies again, reconnect it from the tool and approve the request. ## If a tool call fails with an auth error Run the same request again. The retry re-triggers the browser flow, and most tools do it for you without being asked. If the browser does not open on the retry, restart your AI tool and try once more. :::note{title="Your handle is permanent"} Your handle is derived from your email address when your account is created, and there is no rename path. It identifies your account; dashboard URLs use the workspace's slug, which you choose when you create the workspace. See [Share a dashboard](/guides/share-a-dashboard). :::