Authentication

TestRelic's login system is hosted, not in-app. Sign-in, sign-up, email verification, password reset, and any 2FA/passkey challenge all happen on TestRelic-branded pages served by the platform's identity layer — the web app itself no longer renders its own credential form. This page covers every auth flow: web sign-in, self-service 2FA/passkeys, organization-enforced 2FA, and CLI login.

Sign in

1. Go to testrelic.ai and click Log In.
2. You land on the hosted sign-in page — "Welcome to TestRelic AI / The new way to test software".
3. Enter your email and password, or click Continue with GitHub to sign in with an existing GitHub account.
4. If you (or your organization) have two-factor authentication set up, you're challenged for it in the same flow — see Two-factor authentication and passkeys below.
5. On success, the hosted page hands you back to the platform already signed in.

Because sign-in, verification, 2FA, and passkey challenges all run on the same hosted page in one continuous session, you're never bounced back to a second login screen partway through — the old flow where a pending step (verify email, set up 2FA) forced you to authenticate twice no longer happens.

Sign up

1. From the sign-in page, click Sign Up (or go directly to the hosted registration page).
2. Enter your name, email, and a password — or use Continue with GitHub.
3. If you were invited via a team invitation link, your email is pre-filled and the invite is automatically associated with the new account.
4. Confirm you agree to the Terms of Service and Privacy Policy (shown directly above the links on the sign-up page) and submit.

Forgot password

Click Forgot password on the hosted sign-in page and follow the emailed reset link. Reset links are time-limited; if yours expires, restart the flow from the sign-in page.

Two-factor authentication and passkeys

You can secure your own account with a second factor from Settings → Security:

1. Open Settings → Security.
2. Click Add next to the method you want.
3. You're taken through the identity provider's own secure enrollment ceremony (a full-page flow — registering a passkey or scanning a TOTP QR code), then returned to the Security tab.
4. Your enrolled methods are listed there, with an option to remove any of them.

If you have both a passkey and an authenticator app enrolled, sign-in asks which one you'd like to use. A passkey works at sign-in exactly the same way it works during enrollment — no separate setup is needed to make it usable as your second factor.

Organization-enforced 2FA

Organization admins can require every member to have a second factor.

1. Go to Settings → Organization → Sharing & Security.
2. Toggle Require two-factor authentication.
3. Members who don't yet have a passkey or authenticator app enrolled are prompted to set one up the next time they sign in. Members who already have a factor enrolled are unaffected.

Admins can also manage 2FA for a specific member from Admin → Users:

1. Find the member and click Manage 2FA on their row.
2. View their enrolled methods, revoke any one of them, or toggle Require 2FA for that member individually.

If a member's last remaining factor is revoked while org-enforced 2FA is on, they're prompted to enroll again at their next sign-in — enforcement doesn't have a one-time loophole.

CLI device authorization login

testrelic login authorizes the CLI in your browser instead of asking for a password on the command line:

1. Run testrelic login. The CLI prints a confirmation code and opens your browser to the platform's device-authorization page (/cli/authorize) with the code pre-filled.
2. Sign in to the platform if you aren't already, review the code, and click Authorize.
3. The CLI polls in the background and, once you approve, receives a CLI-scoped tr_mcp_* personal access token automatically — no copy-pasting a key.

If your browser and terminal are on the same machine, approval completes almost instantly; otherwise the CLI keeps polling until you approve (the confirmation code expires after a few minutes if left unapproved). Running testrelic login again rotates the token for that machine rather than piling up unused ones.

For CI and scripted environments, skip the browser flow entirely with a token you generate yourself:

testrelic login --token tr_mcp_xxxxxxxx

See CLI authentication for the full command reference.

Team invitations

Organization admins invite new members from the User Management screen. Invited users receive an email with a unique invite link.

1. Click the link in the invitation email.
2. You land on the hosted sign-up page with your email pre-filled and the invitation already associated with the account you create.
3. If you already have an account, sign in instead to accept the invite.

User roles

TestRelic has two roles within an organization:

Machine-to-machine authentication

Human sign-in (above) is separate from the credentials your SDKs, CLI, and MCP server use to talk to the platform programmatically:

• tr_live_* ingest keys authenticate SDK reporters uploading test runs — see API Keys.
• tr_mcp_* personal access tokens authenticate the MCP server and the CLI (including the device-authorization login above) — see Programmatic Access.

Security notes

• All authentication happens over HTTPS, on TestRelic's hosted identity pages.
• Passwords are never stored in plain text.
• Sessions are maintained via secure, HTTP-only cookies — the browser never handles a raw token for web sign-in.
• CLI and MCP access use long-lived tr_mcp_* personal access tokens rather than passwords.
• Rate limiting is applied to all authentication endpoints to prevent brute-force attacks.