Skip to content

Sign in and authorize

Dashies uses OAuth 2.1 with PKCE, so your AI tool signs in through the browser once. There is no token to copy, paste, or rotate.

The first Dashies tool call your AI makes opens a browser window and asks you to sign in. You do this once per tool. There is no API key to generate and no token to paste anywhere.

What happens when you first publish

Your AI tool drives the whole handshake. You only see the browser step.

1. The tool call returns a 401

Your AI calls a Dashies tool with no credential. The publish service answers 401 with a WWW-Authenticate header pointing at its OAuth metadata.

2. Your tool registers itself

It reads /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource, then registers as a client. This is Dynamic Client Registration, and it is why there is nothing for you to configure.

3. A browser window opens

You land on a Dashies consent screen headed Authorization request. It names the tool that is asking, the handle it would publish as, and the address it will redirect back to.

Click Continue with Google if you are not already signed in.

4. You choose where it publishes

Under Publish to, pick Personal or one of your workspaces. Personal is the default.

5. You approve, and the browser hands control back

Your tool receives an authorization code on a loopback address and exchanges it for an access token. The tool call that started all this now runs.

Check the redirect address before approving

The consent screen shows the address the tool will be redirected to. A local AI tool redirects to a loopback address (http://127.0.0.1:<port> or http://localhost:<port>). Dashies flags a redirect that is not a loopback address, because a remote redirect on a locally-run tool is a phishing signal. Click Deny if the address is not one you expect.

One authorization, one publish target

The target you pick on the consent screen is baked into the grant. A connection authorized to a workspace can act only in that workspace, and a personal connection can act only under your handle. There is no runtime switch.

What a personal authorization can do:

  • Publish, update, rename, and delete dashboards under your handle.
  • Read and list your dashboards, and roll them back to earlier versions.
  • It cannot see or change dashboards owned by anyone else.

What a workspace authorization can do:

  • Publish, update, rename, and delete dashboards in that workspace. They default to members-only.
  • List and read back that workspace's dashboards.
  • It cannot touch your personal dashboards or any other workspace.

To publish somewhere else, authorize again and pick the other target. See Work as a team for how workspace scope interacts with warehouse connections, which is where this trips people up.

Signing in with SSO

If your company uses SAML single sign-on, sign in at dashies.xyz first, using Sign in with SSO and your work email. Once you have a Dashies session in that browser, the consent screen recognises it and you go straight to the approval step.

Your admin has to have configured SAML and verified your email domain before this works. Until then, that domain has no SSO and you sign in with Google instead.

Staying signed in

Access tokens are short-lived, and your tool renews them without involving you. The renewal chain belongs to the authorization rather than to a browser tab, so closing the browser does not end it.

You are asked to sign in again only when:

  • you explicitly sign out,
  • a refresh token is detected as reused, which invalidates the chain, or
  • the sign-in service is unreachable at the moment your tool tries to renew.

Nothing is written to a config file that you need to protect. In Claude Code, the access token is stored in the operating system keychain, and the Dashies entry in ~/.claude.json holds only the connector URL and type.

Check it worked

Ask your AI tool to list your dashboards:

List my Dashies dashboards.

A list comes back, and it is empty on a new account. An empty list is a pass: the tool call completing without an auth error is the signal.

To confirm which identity you authorized as, open dashies.xyz/app and check the account menu. The handle shown there is the one your dashboards publish under.

If a tool call fails with an auth error

Run the same request again. The retry re-triggers the browser flow, and most tools do it for you without being asked. If the browser does not open on the retry, restart your AI tool and try once more.

Your handle is permanent

Your handle is derived from your email address when your account is created, and there is no rename path. If you want a different label in your dashboard URLs, create a workspace, whose slug you choose yourself. See Share a dashboard.