# auth.md

How agents authenticate with renmy runtime.

renmy runtime runs on the developer's machine and in CI. It has no hosted API, so there is no agent registration, no token exchange and no token to revoke.

## Local tools need no credentials

- `renmy mcp` serves the MCP tools over stdio. Register it with `renmy mcp install`, or with `claude mcp add nimbus -- renmy mcp` (the server's registered name is `nimbus`).
- An agent working in a terminal (Claude Code, Cursor, Copilot) can run `renmy test` and the other commands directly.

## Paid features read a licence

- On a developer machine, `renmy login` opens the browser, signs in to the account at https://renmy.net/portal and activates the machine. There is no key to copy.
- In CI or another headless environment, set `NIMBUS_LICENSE_KEY` to the licence key shown in the portal.

## The local Salesforce-compatible server

`renmy serve` exposes a Salesforce-compatible REST API and a gRPC Pub/Sub API on localhost. It uses its own local credentials (`--username`, `--password`, `--auth lax|strict`), not a renmy.net account.