> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tekma.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate the CLI, MCP, and recording links

> Choose the smallest Tekma credential for reading, recording, editing, or submitting a guest capture.

## OAuth for a person or agent

Set the hosted endpoint, then sign in:

```bash theme={null}
export CAPTURE_MCP_URL=https://mcp.tekma.dev/mcp
tekma auth login
tekma auth status
```

The default grant is `captures:read`. Ask for additional scopes only when needed:

```bash theme={null}
tekma auth login --scope "captures:record comments:write captures:write"
```

The CLI steps up interactively at a terminal. In CI or a non-interactive agent, an insufficient-scope result tells you which login command to run. Use `tekma auth logout` to forget the stored credential.

## Personal access tokens

Create a token in **Settings → Agent access**. Choose an expiry and the optional `comments:write` or `captures:write` grants. The token is workspace-scoped, shown once, and still obeys the current role and folder access. Pass it through stdin or the client configuration; do not place it in a shell history or source file. A personal token does not grant OAuth recording upload.

## Recording-link tokens and local mode

An authorized recording-link token can submit only to its configured workspace/link and expires or is revoked with that link. Keep `CAPTURE_RECORD_TOKEN` and the corresponding API endpoint private.

`tekma record … --local` records to local files without OAuth or upload. It returns local media/event paths and no share URL. Use a unique recorder directory when retaining more than one local result.

MCP uses the same account access checks. A share URL can be supplied through the supported share header for a bounded read, but a content-only share does not gain diagnostics through MCP.