# VectorBT PRO authentication

Public content at https://vectorbt.pro needs no authentication. Member content at https://members.vectorbt.pro requires an active VectorBT PRO membership.

## Browser access

[Sign in with GitHub](https://members.vectorbt.pro/auth/login) using the account linked to your membership. This creates a session cookie.

## Agent access

Use a GitHub user access token or personal access token from the member's account. No additional token permissions are needed, including for fine-grained tokens. The token proves identity, and our GitHub App checks repository access.

1. Read the user's configured token (for example, `GITHUB_TOKEN`) from their environment or parse only its value from their local .env file. Do not execute the file.
2. POST to https://members.vectorbt.pro/auth/token with `Authorization: Bearer <github-user-token>`.
3. Use the returned `access_token` in `Authorization: Bearer <access_token>` for member requests to https://members.vectorbt.pro. Reuse it for the lifetime specified by `expires_in` in seconds, then repeat the exchange.

If no token is found, ask the user where it is configured. If they need to create one, direct them to [Using AI](https://members.vectorbt.pro/using-ai/#set-up-your-github-token) for setup instructions.

Never print or log either token. Keep the site token in memory when possible. Issued tokens remain valid until expiry, even if GitHub access is revoked.

## Find content

Fetch https://members.vectorbt.pro/llms.txt with authentication for the full index. Send `Accept: text/markdown` or follow Markdown links. A 401 response means credentials are missing, invalid, or expired.

Authentication metadata: https://members.vectorbt.pro/.well-known/oauth-protected-resource