Skip to main content
Linking is optional. An unlinked machine still runs a complete assessment and still writes all four report formats — the session context simply says This device is not linked, so this scan stays local. Link when you want cloud reports, live progress, or share links.
There is no hosted Myrqen service today. The CLI’s shipped default endpoint, https://api.myrqen.cc, is not deployed — myrqen link against it fails with a network error. To link anything you first need a deployment of your own: see Self-host, then link against its origin.Nothing on this page is required to scan. Scanning, all four report formats, the fix prompt, and applying a fix are unaffected by any of it.

​
Create an account

Sign up in the dashboard of the deployment you are going to link against — http://localhost:3000 for a local one. Two things to expect:
  • No email is sent. Nothing asks you to check an inbox.
  • Ten recovery codes are shown exactly once. That is the only account recovery path. /recover accepts one code together with a new password. Copy the set somewhere safe.
Password rules, from packages/auth/src/password.ts: at least 12 characters, at most 200, and not only whitespace. Browser sessions last 30 days.
Platform administrator rights are granted only to the address configured in PLATFORM_ADMIN_EMAIL, and only when that address signs up. Nobody is promoted implicitly, and a deployment with the variable unset has no administrator at all.
1

The Agent Skill is installed first

link runs the same installation as myrqen install. Skip it with --skip-skill-install if you only want the credential.
2

A link request is created

The CLI generates a verifier, keeps it locally, and sends only its SHA-256 hash. The server answers with an opaque public request id, a browser approval URL, an expiry (10 minutes), and a poll interval. The approval URL never carries a bearer credential.
3

You approve it in a browser

A browser opens <app>/link/<publicRequestId> and shows the device name, platform, CLI version, and expiry. Press Approve this device while signed in.Visiting the URL is never approval. Open it signed out and it sends you to sign in instead.
4

The credential is exchanged once

The CLI presents the verifier and receives the device token exactly once. The server stores only a hash, so a replayed verifier cannot mint a second credential.
5

The token goes into the OS keystore

Keychain on macOS, Credential Manager on Windows, Secret Service on Linux, with a permission-restricted 0600 file as the fallback. myrqen doctor tells you which backend was used.

​
Options

myrqen login is an alias for myrqen link.

​
Point the CLI at your deployment

Or set the endpoint once, which is what you want in practice:
MYRQEN_API_BASE_URL overrides both for a single command. The shipped default is the hosted API rather than localhost deliberately: a published CLI that defaults to a development server would fail on every user’s first link with an error that reads like their own network being broken. That reasoning holds for a released product — but until the hosted service exists, the default is itself unreachable, so setting the URL is a required step rather than an optional one.

​
Confirm the result

This removes the local device credential. It does not delete the account or any synced report.
logout is interactive. In a non-interactive shell — which is what a coding agent usually gives it — it currently returns without removing anything. Run it in a real terminal. The same applies to myrqen workspace --set and myrqen workspace --detach.

​
Next

Run your first assessment

Session context, phases, and finishing.

Cloud sync, quotas, and retention

What syncing does, what it costs against your plan, and when it expires.