Skip to main content

​
OAuth for a person or agent

Set the hosted endpoint, then sign in:
The default grant is captures:read. Ask for additional scopes only when needed:
The CLI steps up interactively at a terminal. In CI or a non-interactive agent, an insufficient-scope result tells you which login command to run. Use tekma auth logout to forget the stored credential.

​
Personal access tokens

Create a token in Settings → Agent access. Choose an expiry and the optional comments:write or captures:write grants. The token is workspace-scoped, shown once, and still obeys the current role and folder access. Pass it through stdin or the client configuration; do not place it in a shell history or source file. A personal token does not grant OAuth recording upload. An authorized recording-link token can submit only to its configured workspace/link and expires or is revoked with that link. Keep CAPTURE_RECORD_TOKEN and the corresponding API endpoint private. tekma record … --local records to local files without OAuth or upload. It returns local media/event paths and no share URL. Use a unique recorder directory when retaining more than one local result. MCP uses the same account access checks. A share URL can be supplied through the supported share header for a bounded read, but a content-only share does not gain diagnostics through MCP.