Build Station signs in once and stays signed in. The token lives in your OS keychain and is refreshed automatically when it expires.
Pick your instance
On first launch Build Station shows an instance selector. Pick the backend URL your organization uses.
1. Default vs custom
Most users pick the listed default (e.g. our.meshly.build). If your organization runs a self-hosted backend, choose Custom instance and enter the URL.
2. Verify the URL
Build Station does a quick health check before accepting. If the URL doesn't respond you'll see a red error — fix the URL or check that the backend is up.
3. Confirm
Click Continue. The instance selector closes and the sign-in screen opens.
Note: Switching instances later
You can change the instance from Settings → Account → Switch instance. Doing so wipes the current login state (you'll re-authenticate against the new instance) but project working-directory mappings persist on disk per-instance.
Sign in with OAuth
1. Click Sign in
The button opens your default browser to the Meshly Build login page. Build Station waits in the background.
2. Authenticate in the browser
Log in with whatever method your instance uses — SSO, email + password, etc.
3. Approve the redirect
After login the browser asks to hand the token back to Build Station via the meshly-station:// deep link. Approve. (If your browser prompts the very first time, set "Always allow" so it doesn't ask again.)
4. Back in Build Station
The main window now shows your project list. The token has landed in your keychain.
What gets stored
| Item | Where | Why |
|---|---|---|
| OAuth access token | OS keychain (login service) | Authenticates API calls and SSE streams to the backend. |
| OAuth refresh token | OS keychain | Auto-renews the access token in the background. |
| Per-agent API keys | OS keychain (one entry per agent) | Each agent has its own bearer token for the MCP server. Auto-fetched from the backend after sign-in, not entered by hand. |
| User profile metadata | App data dir, JSON | Just your display name, user_id, station_id — non-sensitive. |
Note: Nothing sensitive lands in plain text on disk
The settings JSON file contains project paths and agent enablement, but no tokens or keys. Everything sensitive goes to the OS keychain (macOS Keychain or Windows Credential Manager).
Signing out
Tray menu → Settings → Account → Sign out. This:
- Drops the access and refresh tokens from your keychain.
- Stops all SSE listeners.
- Leaves the project list and per-project working-directory mappings in place (so when you sign back in, your setup is intact).
What if the deep link doesn't fire?
Some browsers block custom URL schemes by default. Symptoms: you log in successfully in the browser, but Build Station never updates and keeps waiting. Open the browser's site settings for the Meshly Build domain and allow it to open external apps. See Troubleshooting for platform-specific fixes.