--email mails a one-time code and creates the account and a workspace on first use. In an agent or sandbox shell the first call sends the code and exits; re-run it with --code <code> once the user reads it to you.
There is one credential. The CLI holds it, and everything reads it: the REST API, your project, the skills, and the MCP bridge. Sign in once and nothing else needs configuring.
Cargo here is the GTM platform at getcargo.ai, not Rust’s package manager. Its
binary is
cargo-ai, installed from npm, and it needs no cargo, rustc or
Cargo.toml.Methods
If sign-in does not finish
auth.getcargo.io serves only the OAuth endpoints below and has no pages to visit. The human walkthrough for Claude Code is www.getcargo.ai/with/claude-code.
Calling the API
OAuth
Authorization-server metadata (RFC 8414): https://auth.getcargo.io/.well-known/oauth-authorization-server. Device code, authorization code with PKCE (S256), registration, and revocation. The product MCP server athttps://mcp.getcargo.io challenges with OAuth. See MCP servers.
Machine-readable walkthrough
The WorkOSauth.md walkthrough — Discover, Pick a method, Register, Claim, Use, Revocation — is https://www.getcargo.ai/auth.md.
