# Signing in (/docs/getting-started/authentication)



Use the [dashboard sign-in page](https://berrybox.io/login). GitHub login identifies your account; installing the GitHub App gives BerryBox permission to run CI for the selected repositories.

## Accounts and teams [#accounts-and-teams]

A team owns its GitHub connection, prepaid balance, runner configuration, job history and API keys. Choose the correct team before changing settings or adding credit.

An invitation must be accepted with the intended account. Where email verification is required, complete it before continuing. [Read about invitations](/docs/teams-and-billing/invitations).

## API and agent authentication [#api-and-agent-authentication]

The CLI, MCP and Management API use a **team-bound API key**, not your browser session or a GitHub personal access token. Create a scoped key in the dashboard; new keys expire after 24 hours by default.

Use only the scopes your tool needs. Read-only CI tools need `teams:read` and `ci:read`. Add `billing:read` only when cost or balance access is required and your team role permits it.

[Create and store an agent key safely](/docs/teams-and-billing/management-keys).

<Warning>
  Do not paste API keys, GitHub secrets or payment details into an AI conversation. Enter the key through the CLI's hidden terminal input. Your agent should never need a GitHub App private key.
</Warning>