---
name: shared-account-sign-in
description: Sign in to a target through one of the shared Google, Microsoft, GitHub or Apple accounts (credential rows of type `shared`) without locking it for every engagement. Use before any sign-in with one of those providers.
---

# Shared provider accounts

Rows of type `shared` in `toadcli cred list` are Google, Microsoft, GitHub and Apple accounts every engagement uses. Sign in with those providers through them instead of registering provider accounts, and record the target account that results as its own credential.

Each verification code a sign-in sends counts towards a daily limit that locks the account for everyone.

- `toadcli cred session ID` restores the account's saved sign-in into your browser. Sign in only when that leaves you signed out; trust the browser when asked, then `toadcli cred session ID --save`.
- Never clear a provider's cookies: its trust in the browser is one of them.
- `toadcli cred totp ID` prints the current 2FA code, and SMS codes are in `toadcli sms`.
- Never change a shared account's password, 2FA or recovery settings. When one is challenged or locked, `toadcli cred set --id ID --status challenged` (or `locked`) so others skip it.

## Apple

- `toadcli cred signin ID` signs the Apple account in, with the Apple sign-in open or on a blank browser: it fills Apple's sign-in frame, which your browser's snapshot cannot see, takes the SMS code and saves the sign-in. It alone decides when a challenged Apple account may be tried again.
- The Apple account never works on AppleConnect (`idmsac.apple.com`), Apple's staff sign-in.