# Claude login from the swarm UI

An operator logs an agent in to claude from the agent's card in the swarm UI.
No hive is in the path: the login runs in the swarm's `swarm-claude-login`
service, the credentials go to the agent's own leaf in the secret store, and the
agent's harness installs them from there.

Where it runs and how it's enabled: [`services.md`](services.md#claude-login-minter).

## Logging an agent in

1. The agent's card shows **login needed** with a **log in** button when its
   claude has no session.
2. **log in** opens a dialog with a link. Open it, sign in to the agent's own
   claude account, and paste the code the page shows into the dialog.
3. When the secret store has the login, the dialog closes and the agent picks the
   login up within a few minutes, then resumes its turns.

A started login waits 15 minutes for its code, then stops. Starting another login
for the same agent replaces the running one. A refused code fails the login, and
the dialog shows what claude printed.

The agent's own web UI login (`/login`) still works, unchanged. It goes away once
you have confirmed the swarm login works.

## The stored login

The agent's card shows when the swarm stored its login for it, or that none is.
**delete login** on the card removes the stored login, every version of it, after
asking first. An agent that already holds a session logs out too, the next time
it reads the store: within 5 minutes, or when a paused agent resumes.

An agent installs a stored login only when it's newer than the one it installed
last, so a login that has since gone bad is never put back. The rule and its
reasons are in
[the reference](../../4-implementation/swarm/claude-login.md#why-the-harness-takes-only-a-newer-login).

## Who may log an agent in

The `operatorsOnly` authelia rule on the swarm domain keeps the login routes to
operators; the controller checks only that the gateway named a user. Without that
rule any account authelia admits could store its own claude session as any
agent's, so no agent account may exist before the rule reaches the swarm. Every
hive's policy reads `swarm/agents/*`, so every hive can read every agent's claude
session, as it can read the GitHub token.

The minter's grants, the steps of a login and its metrics are in
[the reference](../../4-implementation/swarm/claude-login.md).