> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enfors.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing credentials

> The enfors CLI for signing in and managing the local watcher.

The [watcher installer](/integrations/gateway-installer) adds an `enfors` command-line tool
for signing in and managing the watcher — the same commands on macOS and Windows.

## Commands

```bash theme={null}
enfors login     # sign in with SSO (opens browser; caches token)
enfors check     # is the watcher running?
enfors start     # start it (and re-enable it at login)
enfors stop      # stop it (and disable it at login, until you start it again)
enfors logs      # tail ~/.enfors/hooks/watcher.log
enfors errors    # tail the watcher error log
enfors version   # installed watcher version
```

## Where credentials live

| Path                                | Contents                                                           |
| ----------------------------------- | ------------------------------------------------------------------ |
| `~/.enfors/hooks/watcher.env`       | Data API URL + Cognito settings.                                   |
| `~/.enfors/hooks/tokens.json`       | Cached Cognito tokens (id / access / refresh) from `enfors login`. |
| `~/.enfors/hooks/enfors_watcher.py` | The watcher itself (also runs the login flow).                     |

## Sign-in

Sign-in is a browser-based **Cognito OAuth2 + PKCE** flow with a local callback on
`localhost:8765`. The resulting id-token is cached and **auto-refreshed** via the refresh
token — you normally sign in once.

```bash theme={null}
enfors login
```

If `enfors check` shows the watcher can't authenticate (e.g. the refresh token was revoked),
run `enfors login` again.

<Tip>
  For programmatic access to the Data API or MCP server, use an `enf_live_…` token rather than
  your SSO session. See [Authentication](/api-reference/authentication).
</Tip>