git:20261107.2591221 to git:20261107.9bda7c0

---

description: Use when a person needs to register or refresh their own Claude or Codex subscription credential for specclaw-fleet runs.

---

# specclaw-fleet login

Stores the caller's own credential in Azure Key Vault so fleet jobs assigned to them can run on their plan. The user runs this themselves; never run it for someone else, and never ask them to paste a token into chat.

```bash

specclaw-fleet login --agent codex --vault <name>

```

- **claude** runs `claude setup-token` in the terminal, then asks the user to paste the printed token at a hidden prompt.

- **codex** runs `codex login` into a temporary `CODEX_HOME` with file credential storage and uploads the resulting `auth.json`.

The secret name comes from a hash of the user's own `az` identity, and per-secret RBAC (granted once by an admin with `specclaw-fleet onboard <upn> --vault <name>`) lets each person write only their own two secrets.

Re-run it when the Claude setup token nears its one-year expiry, or after a codex job reports a failed token refresh.