Account
Teams and sign-in
Orgs, roles, invites, how people sign in, and the keys and tokens that act for them.
SoonThese pages describe Chronos Cloud, which opens from the waitlist. Running Chronos yourself? Self-host docs
Signing in
People sign in at chronos.2090.tech/login with GitHub, or with their email and a one-time code. There are no passwords to leak. Someone who signed in with GitHub before keeps their account: signing in with the same GitHub account, or with the same verified email, finds it.
Orgs
Projects belong to an org. Signing up makes an org of your own on the free plan; being invited adds you to another. Someone in several orgs switches between them from the dashboard’s org menu, and the dashboard remembers the choice. The CLI acts in your first org unless a project in another is named; MCP acts in the org of the project the session names, whichever of your orgs that is.
Roles
| Role | Can |
|---|---|
| owner | everything: people and roles, the plan, deleting a project, production mode, revoking an agent, restoring a backup, Auth settings and keys |
| member | read, write and merge: SQL, tables, approving or discarding held worlds, undoing merges, managing app users |
| viewer | read only: tables, SQL that reads, diffs, reviews, history, activity. A dry run is fine; anything that changes data or a world is refused (403) |
An org always keeps at least one owner: changing or removing the last one is refused until someone else is made owner.
Inviting people
- An owner invites by email or GitHub username, with a role, on the Team page.
- Someone who has signed in before joins at once. Anyone else joins the first time they sign in with that email, or with that GitHub account.
- An invite can be cancelled until it’s taken up; a member’s role changed or removed at any time. Removing someone drops their agents’ access to the org’s databases.
- Anyone can leave an org (unless they’re its last owner).
Keys and tokens
| Credential | Made by | Acts as | Ends |
|---|---|---|---|
| dashboard session | signing in at the site | you, as a person | signing out |
API key ck_… | chronos init / chronos cloud login | you, not as a person | chronos cloud logout |
MCP token mt_… | your coding agent’s OAuth sign-in | you, not as a person | an hour (the client refreshes it; a sign-in lasts 30 days unused); the client revoking it, which ends the sign-in |
| agent token | Chronos, per person and project | claude-<login>-<project> on the database, with your role’s rights (a viewer’s reads) | revoking the agent; it’s made again on next use |
| granted agent token | Chronos, when you approve someone else’s agent | ext-<login>-<project>-…, with the rights you picked | the grant ending: revoked, or its time up (Other people’s agents) |
DATABASE_URL password | the project | the app role | never shown again outside reveal; keep .env private |
Chronos keeps only hashes of keys and tokens. None of them is shown again after it’s made, except the database password on an owner’s or member’s reveal, which is logged.
What only a person can do
Your coding agent holds your API key or MCP token, so those can’t do what needs a person in the dashboard:
- approving (merging) a world, discarding it, undoing a merge;
- revealing the database password;
- inviting people, changing roles, deleting a project;
- approving a terminal’s sign-in on
/device, and an MCP client’s on the consent page.
Notifications
Owners and members can get an email when a world starts waiting for review: one per world version, so an agent that keeps writing doesn’t fill your inbox. Turn it on or off for yourself on the Team page.