Account Authorization

How signing in to Scrubby works, and what each sign-in method gives you access to.

Sign-in methods

From scrubby.ai/account/auth/login, you can sign in with:

• Email and password — create an account with an email address and password.
• Magic link — request a one-time sign-in link sent to your email; no password needed.
• GitHub — authorize the Scrubby GitHub OAuth app.
• Google — sign in with a Google account.
• Passkey — sign in with a device passkey (WebAuthn), once one has been registered on your account.

GitHub OAuth permissions

Signing in with GitHub requests these scopes:

• read:org — reads your GitHub organization memberships, used to detect which organizations you can access on a Team or Business plan.
• user:email — reads your verified email addresses.
• repo — reads repository contents so private repositories can be indexed. Scrubby only reads code for analysis; it never pushes commits or writes to your repositories.

This is separate from the GitHub App installation, which is what powers automated PR reviews and is granted independently.

Account conflicts and merging

If you sign in with GitHub or Google using an email address that's already linked to a different Scrubby account, Scrubby detects the conflict and walks you through merging the two identities.

Sessions

Signing in starts a session that's remembered across visits until you sign out or the session is revoked. Your AI editor's connection to the MCP server authenticates separately, through its own OAuth flow:

• Claude Code uses the MCP OAuth metadata standards for automatic reconnection. If a session expires, run /mcp to reconnect.
• Other MCP-compatible editors authenticate on first connect and persist the session until it's revoked.

Multi-organization access

If you belong to more than one GitHub organization, Scrubby lets you operate in any of them from the dashboard's organization switcher. Repositories, team management, and billing are all scoped to the organization currently selected. Your personal account is separate from any organization — a personal subscription covers your personal repositories, and an organization's Team or Business subscription covers that organization's repositories.

Account recovery

If you signed in with email and password, use Forgot password? on the sign-in page to reset it. If you signed in through GitHub or Google, recovering access to that provider account restores your Scrubby sign-in as well. Scrubby doesn't hold a separate password for OAuth-only accounts.