Skip to main content
Murmur uses GitHub as the identity provider. There are no separate Murmur accounts — you log in with GitHub, and the platform determines what you can access from your GitHub org memberships.

​
Developer authentication

Developers authenticate in two ways depending on the interface: CLI and MCP — the CLI uses your GitHub credentials (via gh auth or a personal access token) to obtain an identity token. Every API call includes this token. murmur setup configures this automatically. Dashboard — the web dashboard uses GitHub OAuth. You click “Log in with GitHub,” authorize the Macroscope GitHub App, and receive a session cookie. The session is encrypted and refreshed automatically.

​
Tenant membership

Your tenant access is derived from GitHub:
  • Personal tenants — every authenticated GitHub user has a personal tenant (github_oauth/{username}). No setup required.
  • Organization tenants — when your GitHub org installs the Macroscope GitHub App, every org member can access that tenant (github_app/{org}). Membership is checked against GitHub’s org membership API on every request.
There is no invite system. If you’re in the GitHub org, you’re in the Murmur tenant. If you leave the org, you lose access.

​
Agent authentication

Agents running on VMs authenticate with an identity token Murmur mints for that specific agent — a signed token whose subject is the agent’s own identity. Murmur resolves it server-side to the agent and authorizes calls against the agent’s own subtree, so a VM can manage its own run and the child agents it launches. The token is sealed into the encrypted profile only that VM can open, decrypted in VM process memory, re-minted each time the agent wakes, and destroyed with the process when the agent stops. Additional permissions reach a running agent through tenant bindings in two ways: a binding granted to running agents directly, or a binding whose grant sets extend_to_runtime_agents — the same grant then applies both to its holder and to the agents the holder spawns. The GitHub credential on the VM (GH_TOKEN — your user token for developer agents, the App installation token for service agents) is used for git and GitHub operations.

​
Service agents

Service agents authenticate to Murmur the same way — with an agent-scoped identity token minted at workflow start. What differs is whose authority they carry: they operate on behalf of the org via their service profile, not a specific developer, and their GitHub credential is the App installation token.