> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nanny.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect to Nanny Cloud

> Log in once, and Nanny forwards your runs to Nanny Cloud (dashboards, cost, and a durable audit trail) while enforcement stays fully local.

## What syncing does

By default, Nanny runs **local-only**: it enforces your limits and rules on your machine and writes an event log to stdout. Nothing leaves the box.

Once a machine is **logged in**, `nanny run` additionally forwards a copy of your run's event log to [Nanny Cloud](https://nanny.run/cloud). In return you get, per organization:

* A dashboard of every run: steps, tokens, stop reasons, models
* Spend and usage trends across all your agents
* Alerts when a run starts to spiral
* A durable, exportable audit trail (compliance tiers)

Enforcement never depends on the network. If the cloud is slow or unreachable, your agent runs exactly as it would locally. Forwarding is best-effort and never blocks or fails a run.

<Note>
  Syncing is **additive**. It changes nothing about how limits and rules are
  enforced, only whether a copy of the event log is sent to your dashboard.
</Note>

## Turn it on

One step, no config to edit, no secret in `nanny.toml`:

```bash theme={null}
nanny auth login
```

This opens your browser to approve. Approve, and the machine is connected: `nanny run` self-mints an app-scoped credential the first time it runs in a given app directory, stored in a gitignored `.nanny/credentials.local.json` alongside your permanent `.nanny/app.json` identity. Now run as usual:

```bash theme={null}
nanny run python agent.py
```

Your run appears in the dashboard within a few seconds of finishing. No code changes, no per-call instrumentation.

<Note>
  Syncing needs only one thing: being logged in on the machine (`nanny auth
      login`). A machine that never logged in never syncs; there's no separate
  project-level switch to flip.
</Note>

## CI and headless machines

A browser flow needs a person. For CI or a headless machine, log in with an API key instead, supplied through `NANNY_API_KEY` (a CI secret) or stdin, never a command argument:

```bash theme={null}
NANNY_API_KEY="nny_..." nanny auth login --token --env prod
# or:  echo "$NANNY_API_KEY" | nanny auth login --token --env staging
```

This logs in without opening a browser. `--env` is required so it targets the right cloud.

## Skip a single run

Forward nothing for one run, without logging out:

```bash theme={null}
nanny run --no-sync python agent.py
```

## Local vs synced

|                         | Not logged in (default) | Logged in                              |
| ----------------------- | ----------------------- | -------------------------------------- |
| Enforcement             | Local, deterministic    | Local, deterministic (unchanged)       |
| Event log               | stdout / file           | stdout / file **+** forwarded to cloud |
| Network required to run | No                      | No (forwarding is best-effort)         |
| Dashboard & trends      | No                      | Yes                                    |

## Turning it off

* **One run:** `nanny run --no-sync`.
* **Your machine, for good:** `nanny auth logout`. To revoke the key everywhere, use the dashboard.