> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qredence.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth sign-in

> Sign in to providers over OAuth, and understand how tokens are refreshed during long-running sessions.

Some providers — GitHub Copilot is the canonical example — expect OAuth instead of a static API key. Fleet Prime Agent handles the flow through `/login` and refreshes tokens dynamically for long-running sessions.

## Sign in

```
/login
```

Pick a provider that supports OAuth. The runtime walks the flow and stores the resulting `OAuthCredentials`. Files land in `~/.prime/agent/auth.json` (mode `0600`).

Not every provider supports OAuth — for those you'll be asked for an API key instead. See [Providers and models](/fleet-prime-agent/guides/providers-and-models) for the mix.

## Token refresh

Providers rotate OAuth tokens. Fleet Prime Agent resolves credentials dynamically with `getApiKey` on every provider call so long-running sessions keep working even when a token expires mid-run. Callers never see a stale token.

## Storage caveats

`packages/ai` used to persist OAuth credentials itself. Storage was removed from the AI layer; each caller is responsible for persisting credentials themselves. In practice you use `auth.json` through the standard `FileAuthStorageBackend`. If you build a custom integration on top of `packages/ai` directly, wire storage up yourself.

## Related

* [Configuration](/fleet-prime-agent/reference/configuration) — `auth.json` layout, permissions, env var overrides.
* [Security](/fleet-prime-agent/reference/security) — trust model and credential handling.