---
title: Sign in and authorize
description: Dashies uses OAuth 2.1 with PKCE, so your AI tool signs in through the browser once. There is no token to copy, paste, or rotate.
updated: 2026-08-04
tier: free
---

The first Dashies tool call your AI makes opens a browser window and asks you to
sign in. You do this once per tool. There is no API key to generate and no token
to paste anywhere.

## What happens when you first publish

Your AI tool drives the whole handshake. You only see the browser step.

:::steps

### 1. The tool call returns a 401

Your AI calls a Dashies tool with no credential. The publish service answers
`401` with a `WWW-Authenticate` header pointing at its OAuth metadata.

### 2. Your tool registers itself

It reads `/.well-known/oauth-authorization-server` and
`/.well-known/oauth-protected-resource`, then registers as a client. This is
Dynamic Client Registration, and it is why there is nothing for you to configure.

### 3. A browser window opens

You land on a Dashies consent screen headed **Authorization request**. It names
the tool that is asking, the handle it would publish as, and the address it will
redirect back to.

Click **Continue with Google** if you are not already signed in.

### 4. You choose where it publishes

Under **Publish to**, pick **Personal** or one of your workspaces. Personal is
the default.

### 5. You approve, and the browser hands control back

Your tool receives an authorization code on a loopback address and exchanges it
for an access token. The tool call that started all this now runs.

:::

:::warning{title="Check the redirect address before approving"}
The consent screen shows the address the tool will be redirected to. A local AI
tool redirects to a loopback address (`http://127.0.0.1:<port>` or
`http://localhost:<port>`). Dashies flags a redirect that is not a loopback
address, because a remote redirect on a locally-run tool is a phishing signal.
Click **Deny** if the address is not one you expect.
:::

## One authorization, one publish target

The target you pick on the consent screen is baked into the grant. A connection
authorized to a workspace can act only in that workspace, and a personal
connection can act only under your handle. There is no runtime switch.

What a personal authorization can do:

- Publish, update, rename, and delete dashboards under your handle.
- Read and list your dashboards, and roll them back to earlier versions.
- It cannot see or change dashboards owned by anyone else.

What a workspace authorization can do:

- Publish, update, rename, and delete dashboards in that workspace. They default
  to members-only.
- List and read back that workspace's dashboards.
- It cannot touch your personal dashboards or any other workspace.

To publish somewhere else, authorize again and pick the other target. See
[Work as a team](/guides/work-as-a-team) for how workspace scope interacts with
warehouse connections, which is where this trips people up.

## Signing in with SSO

If your company uses SAML single sign-on, sign in at
[dashies.xyz](https://dashies.xyz) first, using **Sign in with SSO** and your work
email. Once you have a Dashies session in that browser, the consent screen
recognises it and you go straight to the approval step.

Your admin has to have configured SAML and verified your email domain before this
works. Until then, that domain has no SSO and you sign in with Google instead.

## Staying signed in

Access tokens are short-lived, and your tool renews them without involving you.
The renewal chain belongs to the authorization rather than to a browser tab, so
closing the browser does not end it.

You are asked to sign in again only when:

- you explicitly sign out,
- a refresh token is detected as reused, which invalidates the chain, or
- the sign-in service is unreachable at the moment your tool tries to renew.

Nothing is written to a config file that you need to protect. In Claude Code, the
access token is stored in the operating system keychain, and the Dashies entry in
`~/.claude.json` holds only the connector URL and type.

## Check it worked

Ask your AI tool to list your dashboards:

> List my Dashies dashboards.

A list comes back, and it is empty on a new account. An empty list is a pass:
the tool call completing without an auth error is the signal.

To confirm which identity you authorized as, open
[dashies.xyz/app](https://dashies.xyz/app) and check the account menu. The handle
shown there is the one your dashboards publish under.

## If a tool call fails with an auth error

Run the same request again. The retry re-triggers the browser flow, and most
tools do it for you without being asked. If the browser does not open on the
retry, restart your AI tool and try once more.

:::note{title="Your handle is permanent"}
Your handle is derived from your email address when your account is created, and
there is no rename path. If you want a different label in your dashboard URLs,
create a workspace, whose slug you choose yourself. See
[Share a dashboard](/guides/share-a-dashboard).
:::