> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gunp.la/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication in plamotrack: all methods explained

> Choose between password login, OpenID Connect providers like Google, and personal access tokens for scripts and MCP clients in plamotrack.

plamotrack has one owner account. You can sign in with a password, or delegate sign-in to an OpenID Connect provider like Google. Scripts, cron jobs, and AI assistants (Claude, ChatGPT) use personal access tokens instead of your session — they never touch your browser login.

<CardGroup cols={2}>
  <Card title="Password Login" icon="lock" href="/authentication/password-login">
    The default. A one-time setup token from the API log plus a password you choose. Works from any browser that can reach your instance.
  </Card>

  <Card title="OIDC / Identity Provider" icon="id-card" href="/authentication/oidc">
    Sign in with Google, Keycloak, Authentik, or any OpenID Connect provider. Required for passwordless Claude web and ChatGPT OAuth connections.
  </Card>

  <Card title="Personal Access Tokens" icon="key" href="/authentication/access-tokens">
    For scripts, the REST API, and MCP clients like Claude Desktop and Claude Code. Your browser session is never used by these clients.
  </Card>
</CardGroup>

## Which method is used where

| Method                | Used for                                                    |
| --------------------- | ----------------------------------------------------------- |
| Password              | Browser sign-in (local mode)                                |
| OIDC provider         | Browser sign-in (oidc mode), Claude web & ChatGPT web OAuth |
| Personal access token | REST API calls, Claude Desktop, Claude Code, any MCP client |

<Note>
  You cannot be locked out of plamotrack without a recovery path. See the relevant page for recovery options specific to your auth mode.
</Note>