Authentication

There are two credentials, used in two places.

The per-environment key (engine and REST)

The 10x engine and every REST call authenticate with one header:

X-10X-Auth: <API_KEY>/<ENV_ID>

The key is the secret. The environment ID routes data to the right tenant and is safe to put in config. Generate and rotate the key from console.log10x.com; see API Keys. Air-gapped engines authenticate offline with a signed license.jwt instead; see License.

The MCP sign-in (agent)

The MCP server signs an operator in to a real account two ways:

• Browser device flow. log10x_signin_start returns a code and opens an Auth0 confirmation page. log10x_signin_complete polls for the token and writes ~/.log10x/credentials (mode 0600).
• Pasted key. Call log10x_signin_complete with an api_key taken from console.log10x.com. No browser.

log10x_login_status reports who is signed in and which environments are reachable. log10x_signout revokes the local credentials. With no credentials, the MCP runs read-only against the public demo environment.

Identity for the account is handled by Auth0 (auth.log10x.com). The engine and the REST API never see Auth0; they only check the per-environment key.