> ## Documentation Index > Fetch the complete documentation index at: https://docs.coffeechats.me/llms.txt > Use this file to discover all available pages before exploring further. # Agent sign-in and credentials > The two sign-in paths, the credentials a connection holds, how long each one lasts, and why a replayed credential ends the connection. Signing in to an agent connection is separate from signing in to the Coffee Chats app. After reading this page you will know where the sign-in happens, what the agent host ends up holding, how long each of those credentials lasts, and what makes a connection end by itself. The [quickstart](/mcp/quickstart.md) walks through a first connection end to end. ## Where the sign-in happens Authorization happens on the Coffee Chats connector, in your own browser. Before it shows you a sign-in page, Coffee Chats checks the client identifier, the address the client wants to be sent back to, the permissions it asked for and the connector it says it wants access to. A call that fails any of those checks never reaches a sign-in page. > [!TIP] > > You sign in with Google or with an emailed link, and there is no password anywhere in this flow. Your agent host never sees your Google account and never sees the link Coffee Chats emails you. **Google sign-in** The Google path starts on the connector and comes back to a registered Coffee Chats address after Google has confirmed who you are. Coffee Chats then resolves your account with the same rules the app uses. If your account still needs first-run onboarding, the flow stops and tells you to finish onboarding in the normal Coffee Chats app and then return to the tab that started the authorization. If you sign in with a Google account that is not the one on your Coffee Chats account, the page says so and asks you to sign in with the right one. **Sign-in by email link** For an account that already exists, Coffee Chats can email you a link instead. The link completes only in the browser that started the authorization, and it still needs you to confirm in that browser after you open it. Two consequences follow from the same-browser rule. Another device cannot use the link. A mail scanner that opens links before you do cannot finish the authorization by itself either. If you opened the link on the wrong device, start the authorization again from the agent host and stay in the browser you started in. ## Choosing permissions The Authorize access page shows the name the application supplied, the Coffee Chats account you are signed in with, and every permission the application asked for with the sentence that describes it. The application chooses its own name, so the page labels it unverified and prints the origin under it; trust the origin. For a web application that is the web address its sign-in returns to. For a command-line tool it reads `native://loopback`, meaning a program on your own machine. The page shows the full list of permissions the application asked for, and you approve or deny that list as one choice. If you deny it, nothing is connected, and [permissions](/mcp/permissions.md) explains what a granted list buys. ## Every connection is separate An agent connection is its own delegation. It has its own short-lived access credential and, when you granted the permission to stay connected, its own family of refresh credentials. Being signed in to the Coffee Chats app does not authorize an agent. An agent's credential does not sign you in to the Coffee Chats app. You can have several agent connections at once, and disconnecting one leaves the others alone. ## How long each credential lasts | Credential | How long it lasts | | - | - | | Authorization code, which the agent host trades for an access credential | 5 minutes | | Access credential, which the agent sends on every call | 10 minutes | | Refresh credential, counted from its last use | 7 days | | The connection itself | 30 days | | The browser session you use to sign in, decide review requests and disconnect | 30 minutes | | An authorization you started and have not finished | 10 minutes | | A sign-in attempt, counted from the moment you start it | 20 minutes | | An emailed sign-in link | 15 minutes | The last three rows are the three clocks on one sign-in. The ten-minute one covers the whole authorization your agent host started, so it is the one that runs out first. If any of them runs out, start again from your agent host. ## Renewing access Each refresh credential can be used once. Using it returns a new one and retires the one presented. > [!WARNING] > > Presenting a retired refresh credential ends the whole connection. A credential arriving after it has already been spent is what a stolen credential being replayed looks like, and Coffee Chats treats it that way. A connection therefore belongs to the machine that made it. Do not copy a refresh credential to a second machine or a second agent host. Authorize again from there instead. ## Signing out, and deleting your account Signing out of the Coffee Chats app ends your own browser session. It reads nothing about your agent connections and disconnects none of them. If you want an agent to stop, disconnect it: see [ending a connection](/mcp/revocation.md). Deleting your Coffee Chats account does disconnect every agent connection on it. Account deletion scrubs your record first, and every write an agent could still have in flight checks that record before it commits, so nothing an agent started can land after the deletion has gone through. ## Next steps > **[Permissions](/mcp/permissions.md)** > > What you are agreeing to on the Authorize access page. > **[Ending a connection](/mcp/revocation.md)** > > Where to disconnect, and what a disconnect stops. > **[Limits and budgets](/mcp/limits.md)** > > How often each of these addresses answers. > **[Compatibility](/mcp/compatibility.md)** > > Which agent hosts Coffee Chats accepts today. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.