# Authentication and setup

Provision the device runtime, approve Foxora’s browser-based CLI sign-in, and confirm the active account before running work.

1. Prepare the runtime:

```bash
foxora setup
```

2. Start the device-authorization flow:

```bash
foxora login
```

3. Open the displayed Foxora URL, enter the short code, and approve the intended account.
4. Return to the terminal and verify:

```bash
foxora whoami
foxora doctor
```

The CLI never asks for your Foxora password in the terminal. It stores the approved session in the shared per-user Foxora data home and refreshes it when supported. Run `foxora logout` before switching accounts.

**Expected result:** `whoami` shows the expected email and `doctor` reports reachable runtime, authentication, and gateway layers.