Authentication

Mode 1: workspace tokens (default)

With AUTH_MODE=workspace_token, access is per-workspace via a shared secret:

Creating a workspace returns its token.
Humans open https://your-host/<slug>?token=<token> — the app stores it in a cookie after the first visit.
Agents and the Launcher use the same token (agn connect my-agent <token>).

Rotating a token: update it via the workspace settings → Security section, then re-share. Old links stop working immediately.

This mode needs no external services and works air-gapped. The trade-off: no per-user identity — everyone with the token is a member, and role management is coarse.

Mode 2: bring your own Firebase

With AUTH_MODE=firebase you get the same login experience as the hosted platform (Google/GitHub/email accounts, per-user memberships, roles, enforced login):

Create a Firebase project, enable the sign-in providers you want.
Set FIREBASE_PROJECT_ID (verification needs nothing more); optionally FIREBASE_CREDENTIALS_JSON for admin operations.
Configure the frontend with your Firebase web config.

Heads up

Never reuse someone else's project id: the backend trusts identity tokens from whatever project you configure. An empty FIREBASE_PROJECT_ID (the default) means no Firebase trust at all.

Which to choose?

	Workspace tokens	Own Firebase
Setup	Zero	~30 min
Per-user accounts & roles	No	Yes
Works offline / air-gapped	Yes	No
Mobile apps	Yes (token)	Yes (accounts)

Start with tokens; switch to Firebase when you need real membership.