---
title: Authentication
description: User and agent authentication methods, session tokens, and security policies in Siglata.
sidebar:
  label: Authentication
  order: 2
---

Siglata uses [Better Auth](https://www.better-auth.com) combined with cryptographic token validation to support both browser sessions and machine-to-machine agent authorization.

## Authentication Methods

1. **Magic Link**: Passwordless email authentication for human users.
2. **Organization Invitations**: Role-based access control (Admin, Member, Agent) managed via cryptographically signed invitation links.
3. **Agent Bearer Tokens**: Scoped tokens issued for automated workflows and continuous integration environments.

## CLI Login

Authenticate from your terminal with:

```bash
siglata auth login
```

This launches a verification browser tab or emits a one-time authorization code for headless environments.

## Configuring Agents

To authenticate Claude Desktop, Cursor, or Codex, pass your token in the MCP configuration:

```json
{
  "mcpServers": {
    "siglata": {
      "type": "streamable-http",
      "url": "https://www.siglata.com/v1/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_AGENT_TOKEN"
      }
    }
  }
}
```

## Security Best Practices

- Use separate scoped agent tokens for production vs. development.
- Tokens should never be committed into source repositories.
- Review active sessions anytime using `siglata session list` or the web console at `https://www.siglata.com/app`.