I registered via MCP and now the login tool says my password is wrong.

That's expected. Accounts created with register_account have no password — the bearer token you got back from register_account is your credential. Don't call login; just send that token as an Authorization: Bearer header on every request. If you've lost the token, see the recovery section below.

How do I get a token without a password?

Call the register_account tool once (first_name, last_name, email). It returns a token immediately — no email code, no human step. Store it. That single token authenticates every following call.

Can I set a password anyway?

Yes, and it's a good idea as a backup. While you still hold your token, call set_password with a new password. After that you can use the login tool (email + password) to get a fresh token if you ever lose the current one.

I'm a human, not an agent — how do I log in?

Use the website. Sign in with Google/GitHub/GitLab/X, or request a one-time code (OTP) to your email. Agents can't do the email-OTP flow because they can't read the inbox — that path is for people in a browser.

Treat the token as long-lived but not immortal — store it, and set a password as a fallback so you're never locked out if a token goes stale or you lose it.

Agent & MCP login: bearer token, no password

How an AI agent signs in over MCP: register_account returns a bearer token, and that token is the credential — no password, no email code. What to do if you lose it, and how to set a password as a backup.

If you're an AI agent renting a server here, the thing to understand up front is this: your bearer token is your login. There's no password step, no email code, no human clicking a link. You call one tool, you get a token, and you send that token on everything after. That's the whole model — and getting confused about it is the single most common way agents lock themselves out.

How an agent signs in

Point your MCP client at https://mcp.eqvps.com/mcp and call register_account with a first name, last name, and email. It returns a token right away:

Authorization: Bearer <token>

Send that header on every subsequent MCP call. That's it. No password is created that you'd ever type, no verification email is sent, no person is involved. The token proves who you are, and it's bound to your account — it can't touch anyone else's.

Want to confirm it worked? Call whoami — it returns your account id, name, and email if the token is valid.

The mistake to avoid

The login tool exists, and it takes an email and a password. If you registered as an agent, you have no password, so login will reject you — and if you've already thrown away the token from register_account, there's now nothing to log in with. This is exactly how an agent ends up stuck: it registered, used the token for a while, dropped it, then reached for login and hit a wall.

So the rule is simple: save the token from register_account. It is the credential. Reusing it is the normal path; login is not.

Recovery: set a password as a backup

Because a lost token with no password means a locked-out account, there's a fallback — set a password while you still have the token:

Call set_password with a new password (8+ characters, letters and numbers). It needs no current password the first time, because your token already proves it's your account. Once that's done, you have a second way in: the login tool with your email and that password will mint a fresh token whenever you need one.

Do this early, right after register_account, and you never have to worry about a stale or lost token again. It's two calls: register, then set a password.

Humans: use the website

None of the above applies if you're a person. Open the dashboard in a browser and sign in with Google, GitHub, GitLab, or X, or ask for a one-time code (OTP) sent to your email. Agents specifically can't use OTP — they can't read the inbox to fetch the code — which is why the token flow exists for them in the first place.

The short version

Agent: register_account → save the token → send it as Authorization: Bearer. That token is your login.
Back it up: call set_password once while you hold the token, so login becomes a recovery path.
Lost the token and never set a password? You're locked out — open a ticket and we'll set one for you. Better to avoid it: save the token, set a password.
Human: just use the website — OAuth or an email OTP code.

If you're wiring an agent up for the first time, pair this with delegating access when one agent needs to operate a server another agent owns.