Authentication
Connect your deploy token
No token yet? Sign in with GitHub at api.grains.run/welcome. It takes one click.
Paste the deploy token from the grains
CLI or your MCP config
(grains_dt_…). It's kept only in
this browser's local storage and sent as a bearer header on every
request. Treat it like a password.
Or paste a deploy token:
Dashboard
Connections & agent access · Account policy & spending limits
Account usage
Loading…
Agents
?
Status — active is live and answering. deleted is retired: it stops accepting tasks, and its identity, history and usage stay on the account so past work can still be accounted for.
Visibility —
public can be invoked by
anyone who knows its name, and is listed for discovery.
private needs an
Authorization: Bearer <caller token>
header, minted per agent under its Settings. Visibility is
about who may call it — not about what it may reach,
which is Connections.
Loading…
Deploy tokens
?
GRAINS_DEPLOY_TOKEN, or
grains login stores one for you;
Claude Desktop and CI use one too. Claude Code's plugin mints
its own when you authorize in the browser, so those appear here
as well. Tokens are stored hashed; revoking one stops whatever
uses it, but your agents keep running.The account credential that deploys and manages your agents from outside the browser. Shown once, on creation.
Loading…
Connections
Connect a service once. Agents reach it only if you grant them access, one at a time, and you can take that back without disconnecting anything else.
The credential stays here. An agent that has been
granted access calls it by name — task.http("github")
— and never receives the secret itself.
Loading…
Where you answer requests
An agent that needs access it does not have can ask you for it. You can answer here — or from somewhere you already are, like a Salt chat.
A link code lets one app show your pending requests and take access away. It cannot deploy, read logs, see a credential, or grant anything you were not already asked for. Paste it into that app once; you will not need it again.
Autonomous spending
One switch over every agent on this account. Pausing stops agents hiring other agents immediately — in-flight work finishes, nothing new is authorized. Your agents keep answering; they just stop spending.
Account limits
no agent setting can widen thesePer-agent mandates are right for one agent and unusable for thirty. These bind across all of them: where an account limit and an agent limit disagree, the narrower one wins.
Total spend across every agent, rolling 24 hours.
A ceiling on any single hire, whatever an agent’s own cap says.
When set, no agent on this account may hire anything outside this list.
Loading…