Semgrep Guardian authentication

How you sign in depends on which coding agent you use. Claude Code is the recommended setup.

Claude Code
Other coding agents

Claude Code uses Semgrep’s hosted remote server and authenticates through OAuth, so developers don’t need to install or run the Semgrep CLI. Each developer completes a one-time browser login when they first use the plugin. Semgrep refreshes access tokens automatically, so developers rarely need to sign in again.

Credentials

OAuth credentials are written to ~/.semgrep/guardian.yml when you sign in through the remote Claude Code plugin.At startup, Guardian fetches its default authentication method from Semgrep’s remote server. OAuth is currently the default for users who are not yet signed in. This setting is global and not configurable per user.If OAuth credentials are present in guardian.yml, Guardian uses them instead of any API token in ~/.semgrep/settings.yml.

Scans running under an unexpected account

If you are switching from a local CLI setup to the remote Claude Code plugin, an existing OAuth session in guardian.yml takes precedence over CLI credentials in settings.yml. If scans run under a different account than you expect, check which file contains active credentials. Use semgrep logout to remove CLI credentials from settings.yml.To sign in with the legacy API-token method in Claude Code, ask the Guardian MCP to log in to Semgrep using the legacy method.

Other integrations run Semgrep through a locally installed CLI. Each developer signs in with semgrep login, which opens a browser-based login flow. See Install the Semgrep CLI only if you need one of these setups.

Credentials

Credentials are written to ~/.semgrep/settings.yml when you sign in through semgrep login or set an API token manually. This is the same file the Semgrep CLI uses. If you are already logged in through semgrep login, Guardian can use those credentials.

Shared tokens and service accounts

Shared API tokens and service accounts are not recommended. Each developer should authenticate individually — through OAuth in Claude Code, or semgrep login elsewhere — so Semgrep can associate activity with the correct user. Semgrep discourages sharing app or API tokens across a team because:

Revoking a shared token affects every user who depends on it.
Shared credentials are rate-limited as a single user, which can throttle scans when many developers run Guardian concurrently.
An API token in settings.yml is only used when no OAuth session exists in guardian.yml. Prefer OAuth for enterprise rollouts.