> ## Documentation Index
> Fetch the complete documentation index at: https://docs.expanse.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How Expanse authenticates users.

Expanse authenticates users with a personal API key, created from the Console settings page after you sign in through your organisation's SSO. Your API key is the only long-lived credential you hold; compute registration hands you a single-use, short-lived install token that the installer exchanges for the compute's own credential.

## Sign in

```bash theme={"dark"}
# provide your exp_user_* key with --api-key (or set EXPANSE_API_KEY):
expanse login --api-key exp_user_…
```

Provide your personal `exp_user_*` API key (via `--api-key` or the `EXPANSE_API_KEY` environment variable); the CLI mints and stores a local session. The key itself is created in the Console, not by the `login` command. Confirm it worked:

```bash theme={"dark"}
expanse status
```

## Personal API key

Your personal `exp_user_*` key is scoped to the teams and computes you can access. It authenticates your CLI session; behind the scenes the CLI exchanges it for short-lived signed tokens automatically, so the key itself never travels beyond sign-in. Console sessions use your SSO sign-in, not the API key.

If you suspect a key is compromised, revoke it from [console.expanse.sh/settings](https://console.expanse.sh/settings) and sign in again.

## Compute credentials

When a compute is registered, the daemon receives its own credential automatically: the installer exchanges the single-use install token for it and writes it straight into the daemon config. You never need to read or type it; on Kubernetes you mount the generated config file into the chart as a Secret. To replace a compute credential, re-register the compute with `expanse compute register` and run the printed install command again.

## Privacy-aware deployments

Expanse runs hosted by default. Privacy-conscious enterprises can instead run the data plane and intelligence plane inside their own infrastructure, so workload telemetry, source bundles, and intelligence reasoning stay on your network; in that mode only identity (SSO, organisation membership, licence validation) goes through the Expanse control plane.

SSO ties into your existing IdP (Okta, Entra, Google Workspace, or any OIDC-compatible provider).

[Reach out](mailto:contact@expanse.org.uk) for a deployment walkthrough.