# How agents get credentials for Konstant

Most of Konstant needs no credential at all, and that is deliberate. This page says exactly where authentication begins.

## No credential needed

- This site, its [MCP server](https://konstant.cloud/.well-known/mcp.json) (`https://konstant.cloud/api/mcp`, no authentication), the [site API](https://konstant.cloud/openapi.json), and every machine-readable file here.
- The Boombox local kit. `npm install --save-dev --save-exact --ignore-scripts @konstantdotcloud/boombox` then `node ./node_modules/@konstantdotcloud/boombox/dist/boombox.js project init .` runs entirely on your machine: repository scan, the plan, local builds, evaluation runs, and application or workload planning. No account exists at this stage and nothing leaves the machine.

## Where authentication begins

Credentials enter only when work connects, and every connected action asks for its own exact permission:

1. **Builder workspace.** `boombox login` opens a browser sign-in and writes a credential to `~/.boombox/config.toml` (created with 600 permissions, sent only to the enrolled gateway, never written into repository content or telemetry). Any principal accepted by the sign-in can create or resume one personal workspace; there is no anonymous hosted session.
2. **Product account.** `boombox login --account` is a separate, second decision for live company or customer work. The browser presents authorized accounts by human label; the connection stores the internal identity, and neither connection inherits the other's authority.
3. **Inspection and revocation.** `boombox credentials list` shows metadata for the current credential (never values, never peer devices); `boombox credentials revoke <credential_id>` self-revokes it. A lost device is recovered by running `boombox login` again.

There are no API keys to create on this site, no OAuth application to register, and no sandbox credentials: the free local kit is the sandbox. Questions: pilot@konstant.cloud. The full contract lives in the package README on [npm](https://www.npmjs.com/package/@konstantdotcloud/boombox) and the guide at [boombox.konstant.cloud/docs](https://boombox.konstant.cloud/docs).