Credentials and privacy
How the hosted connector, local tools, and browser export handle your TrainHeroic login.
Every surface signs in to TrainHeroic with an existing email and password. Where those credentials live depends on how you connect.
| Surface | Where it runs | Credential handling |
|---|---|---|
| Hosted connector | Cloudflare Worker | Stored server-side behind the OAuth grant and encrypted props |
| Local MCP server | Your computer | Read from the MCP client’s environment or config file |
| CLI and SDK | Your process | Read from environment variables or values supplied by your code |
| Browser export | Your browser | Sent directly to TrainHeroic, then discarded; never sent to this site |
Hosted connector
Claude receives an OAuth access token for the connector. The Worker uses the encrypted grant properties to sign in upstream; it never forwards Claude’s bearer token to TrainHeroic.
Local tools
Environment variables and MCP config files are plaintext. Shell commands can also land in your
history. Treat TRAINHEROIC_EMAIL and TRAINHEROIC_PASSWORD like any other secret, and do not
commit an MCP config containing them.
Sessions and caches
TrainHeroic does not issue refresh tokens. The client keeps a session token in memory and signs
in again after a 401 or 403. The CLI and local coach server cache session and exercise-library
data under ~/.trainheroic/ so repeated commands do less work.