---
title: Authentication and access
description: Device ownership, email OTP login, invitations, sessions, and site tokens.
order: 3
---

# Authentication and access

Anonymous pushes use a local device identity. They create public, read-only sites with a 72-hour expiry. `scrapheap login` uses an agent registration/browser-code ceremony plus a six-digit email OTP and atomically claims all active sites from that device.

CLI access tokens last one hour. The CLI refreshes them from a revocable 30-day registration credential. `scrapheap logout` revokes the registration, refresh material, and outstanding access tokens.

Private sites allow the owner and invited, email-verified users. Invitations are normalized to lowercase email records. Access is granted before delivery; a failed email returns a retryable warning, and repeating the invitation resends the direct site link. Removal revokes access immediately.

Dashboard-created site tokens are shown once and stored hashed:

- `site:read` reads metadata and deployment history.
- `site:deploy` adds push, file materialization, finalization, and rollback.

Tokens are bound to one site and cannot change access, invitations, tokens, or deletion. The default expiry is 90 days; owners can explicitly choose no expiry.