Managing credentials - Enfors

The watcher installer adds an enfors command-line tool for signing in and managing the watcher — the same commands on macOS and Windows.

Commands

enfors login     # sign in with SSO (opens browser; caches token)
enfors check     # is the watcher running?
enfors start     # start it (and re-enable it at login)
enfors stop      # stop it (and disable it at login, until you start it again)
enfors logs      # tail ~/.enfors/hooks/watcher.log
enfors errors    # tail the watcher error log
enfors version   # installed watcher version

Where credentials live

Path	Contents
`~/.enfors/hooks/watcher.env`	Data API URL + Cognito settings.
`~/.enfors/hooks/tokens.json`	Cached Cognito tokens (id / access / refresh) from `enfors login`.
`~/.enfors/hooks/enfors_watcher.py`	The watcher itself (also runs the login flow).

Sign-in is a browser-based Cognito OAuth2 + PKCE flow with a local callback on localhost:8765. The resulting id-token is cached and auto-refreshed via the refresh token — you normally sign in once.

enfors login

If enfors check shows the watcher can’t authenticate (e.g. the refresh token was revoked), run enfors login again.

For programmatic access to the Data API or MCP server, use an enf_live_… token rather than your SSO session. See Authentication.