Users sign in with their corporate identity. The launcher embeds a short-lived, printer-scoped access token, and manual setups use the user email address and an access token from the profile.