Authentication

Murmur uses GitHub as the identity provider. There are no separate Murmur accounts — you log in with GitHub, and the platform determines what you can access from your GitHub org memberships.

​

Developer authentication

Developers authenticate in two ways depending on the interface: CLI and MCP — the CLI uses your GitHub credentials (via gh auth or a personal access token) to obtain an identity token. Every API call includes this token. murmur setup configures this automatically. Dashboard — the web dashboard uses GitHub OAuth. You click “Log in with GitHub,” authorize the Macroscope GitHub App, and receive a session cookie. The session is encrypted and refreshed automatically.

​

Tenant membership

Your tenant access is derived from GitHub:

• Personal tenants — every authenticated GitHub user has a personal tenant (github_oauth/{username}). No setup required.
• Organization tenants — when your GitHub org installs the Macroscope GitHub App, every org member can access that tenant (github_app/{org}). Membership is checked against GitHub’s org membership API on every request.

There is no invite system. If you’re in the GitHub org, you’re in the Murmur tenant. If you leave the org, you lose access.

​

Agent authentication

Agents running on VMs authenticate with identity tokens scoped to a single session. The token is part of the encrypted developer profile — it is decrypted in VM process memory and used for all API calls the agent makes. When the agent stops, the token is destroyed with the process.

​

Service agents

Service agents authenticate with credentials minted from the GitHub App installation token at workflow start time. They operate on behalf of the org, not a specific developer.

---