--server.
~/.tuneplane/ with mode 0600. TUNEPLANE_SERVER supplies the
address when nothing is remembered.
The browser flow is OAuth with PKCE. On a deployment configured for OIDC it redirects to single
sign-on. --no-browser behaves like --device-flow.

Console sign-in. The same page is used when tp login opens a browser.
Check it worked
tp logout when you are done on a shared machine.