# TendBase authentication

TendBase starts its MCP connection without asking the agent for a password or token. When a protected tool needs access, the client begins OAuth and opens a browser handoff.

The user verifies their email in that browser. The MCP client receives and stores the resulting authorization. The agent must never ask the user to paste an email code, access token, password, or private key into chat.

If the client says authorization is required, run its MCP login action again. If access expired, reconnect. If the user authenticated the wrong email, clear that TendBase connection in the client and repeat the browser flow.