tp login
Login state is written to
~/.tuneplane/ (permissions 0600). The browser flow uses OAuth + PKCE; when the platform is configured with OIDC (e.g. Casdoor), it automatically redirects to single sign-on.

Console login. The same page is used when tp login opens a browser.