One set of credentials, every platform. Treasure AI Studio authenticates against your existing Treasure AI account, so there are no API keys to manage and no additional password beyond your organization's SSO. The sign-in flow differs slightly per platform — Web derives your region from its URL, while Desktop and Mobile ask you to pick one — and this page covers all three, plus how sessions refresh and how to sign out cleanly.
Treasure AI Studio signs you in with OAuth 2.0 Authorization Code flow plus PKCE, federated to your organization's identity provider through Treasure AI. Your credentials go to your identity provider, never to Studio, and authorization codes are never exposed in a browser URL.
Sign in to Treasure AI Studio on your platform and establish a session that refreshes without prompting you again.
- A Treasure AI account with SSO access enabled
- Your account region — US01, AP01, EU01, or AP02 (required on Desktop and Mobile; Web determines it from the URL)
Treasure AI Studio runs in four production regions. Each has its own isolated deployment, and your account exists in exactly one of them.
| Region | Shown As | AWS Region |
|---|---|---|
| US01 | US01 - United States | us-east-1 (N. Virginia) |
| AP01 | AP01 - Japan | ap-northeast-1 (Tokyo) |
| EU01 | EU01 - Europe | eu-central-1 (Frankfurt) |
| AP02 | AP02 - Korea | ap-northeast-2 (Seoul) |
Your region determines where your Studio data lives and which geography processes your prompts — see LLM Data Residency by Region. To check the region of a signed-in session, open Settings → Profile and read the Environment value (for example, production-us01).
Only regions with a live Treasure AI Studio deployment appear on the sign-in screen. If your account's region is missing, contact your Customer Success Manager.
On Web, the URL you open determines the region — each region has its own Studio address — so there is no region picker.
- Open your organization's Treasure AI Studio URL.
- The sign-in screen shows the Treasure AI Studio logo above the heading "Welcome to Treasure AI Studio" and a single button.
- Click Sign in with Treasure Data.
- The Treasure AI sign-in page opens in the same browser tab. Enter your credentials, or complete your organization's identity provider flow.
- After you authenticate, the browser returns to Studio. A brief "Signing in…" state appears while the session is established, then the Studio landing page loads.
Each region is served from its own hostname, so opening the URL has already selected the region. Signing in to a different region on Web means opening that region's URL — there is nothing to switch inside the app.
The Desktop app can reach any production region, so it asks you to choose one before signing in.
- Launch Treasure AI Studio — from Applications on macOS, or the Start menu on Windows.
- The welcome screen shows the heading "Welcome to Treasure AI Studio" and the subtitle "Select your region to sign in with Treasure Data".
- Select your region. Each row is a radio button with its label and description — for example, "US01 - United States".
- Click Sign in with Treasure Data.
- Your default system browser opens the Treasure AI sign-in page. Enter your credentials and complete authentication.
- The browser hands control back to the Desktop app automatically. A "Signing in…" screen appears briefly, then Studio is ready.
The region picker arrives with the first region already selected, and Sign in with Treasure Data is active immediately. Confirm the selected row is your region before you click it, or you will be sent to another region's sign-in page where your account does not exist.
The Desktop app registers a custom URL scheme for its OAuth callback. After you authenticate in the browser, the authorization code returns to the app over that scheme and is exchanged for tokens using PKCE. The app stores those tokens encrypted with your operating system's key store — Keychain on macOS, DPAPI on Windows — not in plain text.
If the browser does not return you to the app:
- Make sure Treasure AI Studio is still running when you complete authentication.
- Quit and relaunch the app, then sign in again.
- The app must be the registered handler for its custom URL scheme. Reinstalling restores the registration in most cases.
- Open Treasure AI Studio on your iPhone or iPad.
- The welcome screen shows "Welcome to Treasure AI Studio" with the subtitle "Select your region to sign in with Treasure Data".
- Tap your account region. Each option shows a radio button with its label and description — for example, "US01 - United States". The first region is pre-selected, so confirm the tapped row is yours.
- Tap Sign in with Treasure Data.
- An in-app browser opens the Treasure AI sign-in page. Enter your credentials and complete authentication.
- The browser closes and a "Loading..." indicator appears briefly while the session is established.
The iOS app stores its refresh token in the device's secure storage, backed by the iOS Keychain. On later launches it refreshes the session silently, so you stay signed in until the refresh token expires or you sign out.
Troubleshooting:
- The sign-in page does not load — check your network connection and confirm you selected the correct region for your account.
- You see the sign-in screen after a period of inactivity — tap Sign in with Treasure Data again. The app attempts a silent refresh first.
| Aspect | Behavior |
|---|---|
| Token storage | Web: the browser session, managed by the identity SDK. Desktop: local tokens encrypted with the OS key store (macOS Keychain, Windows DPAPI). Mobile: device secure storage backed by the iOS Keychain. |
| Token refresh | Automatic — tokens refresh before they expire, with no prompt. |
| Multi-device | Sign in on Web, Desktop, and Mobile at the same time. |
| Multi-account | One account per session. To use a different account or region, sign out first (Desktop and Mobile) or open the other region's URL (Web). |
| Sign out | Web/Desktop: Settings → Profile → Sign Out. Mobile: Settings sheet → Sign Out. |
Signing in establishes your Studio session. Separately, Studio holds a Treasure AI credential that agents use for data operations — and that credential is never placed inside the agent's sandbox. See Credentials Never Enter the Sandbox.
- Click your user avatar in the sidebar footer to open Settings.
- In the left navigation, under User, click Profile.
- Click Sign Out.
- Tap the user icon in the top-left of the header to open the settings sheet.
- At the bottom of the sheet, tap Sign Out.
- Confirm when prompted.
Signing out clears your local session and resets local state. Your chat history, files, and work folder configurations stay on the server and are there when you sign in again — subject to your organization's Chat Data Retention period.
Settings → Profile also offers Invalidate TD Credential. This removes the stored Treasure AI credential that agents use for data operations, without signing you out of Studio. The next time an agent needs Treasure AI access, you are prompted to authorize again.
Use it when you authorized with the wrong Treasure AI account, or when you want to force re-authorization after a permission change.
Invalidate TD Credential clears the data credential only — your Studio session continues. Sign Out ends the session but leaves the stored data credential in place for your next sign-in. If you are handing a device to someone else, sign out.
- The Studio landing page appears with the title "Let's build something"
- Your email appears in the sidebar footer (Web and Desktop) or in the settings sheet (Mobile)
- Settings → Profile shows the expected Environment value for your region
- A test message gets a response from the agent
| Issue | Solution |
|---|---|
| Sign-in redirects to a blank page | Confirm you selected the correct region (Desktop and Mobile) or opened the correct regional URL (Web). Clear the browser cache, or restart the app, and retry. |
| "Authentication failed" | Confirm your Treasure AI credentials are valid and that your organization has Treasure AI Studio enabled. Contact your administrator if it persists. |
| Your session expired unexpectedly | Sessions end after a period of inactivity. Sign in again — your chat history is preserved on the server. |
| Sign-in fails from one specific network | Your identity provider may restrict which networks can start a sign-in. See Access Control. |
| You signed in with the wrong Treasure AI account | Use Invalidate TD Credential on Settings → Profile to clear the stored data credential, then authorize again. |
- Access Control — How permissions and IP policies apply to Studio
- Security Overview — Sandbox isolation, encryption, and data residency
- Getting Started — Install and set up Studio per platform
- Settings — Personal and organization settings