> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrqen.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Link a device

> Create an account and bind this machine to it, so scans can optionally sync, go live, and be shared.

Linking is **optional**. An unlinked machine still runs a complete assessment and still
writes all four report formats — the session context simply says
`This device is not linked, so this scan stays local.`

Link when you want [cloud reports, live progress, or share
links](/concepts/cloud-sync).

<Warning>
  **There is no hosted Myrqen service today.** The CLI's shipped default endpoint,
  `https://api.myrqen.cc`, is not deployed — `myrqen link` against it fails with a network
  error. To link anything you first need a deployment of your own: see
  [Self-host](/guides/self-host), then link against its origin.

  Nothing on this page is required to scan. Scanning, all four report formats, the fix
  prompt, and applying a fix are unaffected by any of it.
</Warning>

## Create an account

Sign up in the dashboard of the deployment you are going to link against —
`http://localhost:3000` for a local one.

Two things to expect:

* **No email is sent.** Nothing asks you to check an inbox.
* **Ten recovery codes are shown exactly once.** That is the only account recovery path.
  `/recover` accepts one code together with a new password. Copy the set somewhere safe.

Password rules, from `packages/auth/src/password.ts`: at least 12 characters, at most
200, and not only whitespace. Browser sessions last 30 days.

<Note>
  Platform administrator rights are granted **only** to the address configured in
  `PLATFORM_ADMIN_EMAIL`, and only when that address signs up. Nobody is promoted
  implicitly, and a deployment with the variable unset has no administrator at all.
</Note>

## Link this machine

```bash theme={null}
myrqen link
```

<Steps>
  <Step title="The Agent Skill is installed first">
    `link` runs the same installation as [`myrqen install`](/getting-started/installation#install-the-agent-skill).
    Skip it with `--skip-skill-install` if you only want the credential.
  </Step>

  <Step title="A link request is created">
    The CLI generates a verifier, keeps it locally, and sends only its SHA-256 hash. The
    server answers with an opaque public request id, a browser approval URL, an expiry
    (10 minutes), and a poll interval. The approval URL never carries a bearer
    credential.
  </Step>

  <Step title="You approve it in a browser">
    A browser opens `<app>/link/<publicRequestId>` and shows the device name, platform,
    CLI version, and expiry. Press **Approve this device** while signed in.

    Visiting the URL is never approval. Open it signed out and it sends you to sign in
    instead.
  </Step>

  <Step title="The credential is exchanged once">
    The CLI presents the verifier and receives the device token **exactly once**. The
    server stores only a hash, so a replayed verifier cannot mint a second credential.
  </Step>

  <Step title="The token goes into the OS keystore">
    Keychain on macOS, Credential Manager on Windows, Secret Service on Linux, with a
    permission-restricted `0600` file as the fallback. `myrqen doctor` tells you which
    backend was used.
  </Step>
</Steps>

### Options

| Flag                   | Effect                                                                                                               |
| ---------------------- | -------------------------------------------------------------------------------------------------------------------- |
| `--url <url>`          | App base URL to link against. Defaults to `https://api.myrqen.cc`, which is **not deployed** — pass your own origin. |
| `--device-name <name>` | The label shown on the approval page and in device lists.                                                            |
| `--no-open`            | Do not open a browser; print the URL instead.                                                                        |
| `--skip-skill-install` | Link only, without installing the Agent Skill.                                                                       |

`myrqen login` is an alias for `myrqen link`.

### Point the CLI at your deployment

```bash theme={null}
myrqen link --url http://localhost:3000
```

Or set the endpoint once, which is what you want in practice:

```bash theme={null}
myrqen config set-url http://localhost:3000
```

`MYRQEN_API_BASE_URL` overrides both for a single command.

The shipped default is the hosted API rather than `localhost` deliberately: a published CLI
that defaults to a development server would fail on every user's first `link` with an error
that reads like their own network being broken. That reasoning holds for a released
product — but until the hosted service exists, the default is itself unreachable, so
setting the URL is a required step rather than an optional one.

## Confirm the result

```bash theme={null}
myrqen status     # account, device, and quota state
myrqen doctor     # what this machine and agent setup can assess
```

## Unlink

```bash theme={null}
myrqen logout
```

This removes the local device credential. It does not delete the account or any synced
report.

<Warning>
  `logout` is interactive. In a non-interactive shell — which is what a coding agent
  usually gives it — it currently returns without removing anything. Run it in a real
  terminal. The same applies to `myrqen workspace --set` and `myrqen workspace --detach`.
</Warning>

## Next

<CardGroup cols={2}>
  <Card title="Run your first assessment" icon="play" href="/getting-started/first-assessment">
    Session context, phases, and finishing.
  </Card>

  <Card title="Cloud sync, quotas, and retention" icon="cloud" href="/concepts/cloud-sync">
    What syncing does, what it costs against your plan, and when it expires.
  </Card>
</CardGroup>