Signing in
What a new account goes through, from the sign-in screen to the questionnaire, and what each step needs from you.
The sign-in screen is one screen that steps through its own states rather than a set of pages. Knowing the sequence is useful, because it is where a new user's first impression is made.
The steps a person sees
| Step | On screen | What it does |
|---|---|---|
| Choose how to continue | Welcome | Email, or one of the social buttons |
| Email options | Continue with email | Sign in, or create an account |
| Sign in | Welcome back | Address and password |
| Create an account | Create your account | Address, password, and the confirmation code that follows |
| Check the inbox | Check your inbox | A six-digit code that works once and expires in ten minutes |
| Done | You are in | Continues to the questionnaire |
| Reset | Reset your password | Asks for a code, then for a new password |
Anything already signed in that visits /sign-in is sent to the dashboard instead. /sign-up is the same
screen, opened on the registration step.
What each step needs from you
To let people sign up at all
System → Security decides who may create an account: anybody, only invited people, or only addresses on
domains you list. On a fresh installation it is anybody, which is right for testing and rarely right for a
public address.
To send codes
RESEND_API_KEY and EMAIL_FROM on the deployment, with a verified sending domain. Confirmation and reset
are the two messages that stand between a person and their account, so this is the first thing to test with a
real address. See Email that arrives.
To offer Google or GitHub
GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET, or the GitHub pair, on the deployment. Unconfigured, the
button is still drawn and says the provider is not configured when it is pressed, which is a better answer
than a button that does nothing. See Google sign in.
To decide what is asked afterwards
System → Onboarding holds the questionnaire: which of the four steps are asked, in what order, whether they
can be skipped, and what a new account starts with when they are.
The questionnaire
Four steps, and none of them is a gate: style, emails, role and size. The first arrives with an answer already chosen, so somebody in a hurry can press forward and still end with sensible preferences.
The answers do three things: they set the account's appearance defaults, they decide which messages the account receives, and they give you a shape of your users that is worth more than it looks (a product that is mostly used by solo builders should not be marketed at agencies).
Onboarding is the owner's screen to configure
Which steps, in what order, skippable or not, and the choices offered: all of
it is System → Onboarding. Turning a step off is not the same as removing
it, and the order is what people see first.
Accounts and how they are made
| Method | Creates | Recoverable by |
|---|---|---|
| Email and password | One account, after a code confirms it | Email reset |
| One account, no password | The provider, as long as it is configured | |
| GitHub | One account, no password | The provider, as long as it is configured |
| An invitation from a team | One account with a seat claimed | The invitation, until it expires |
Two accounts at the same address are two accounts. This installation does not merge them, because a provider
proving an address is not the same as proving somebody owns the mailbox. When it happens, People → Users is
where the plan and the credits of the one you meant are moved across.
Passwords and sessions
- Eight characters minimum, and the floor is a setting in
System → Security. - A session lasts as long as that screen says, and can be ended from inside the product, in the account's own settings, or from the panel, for everybody at once.
- A password change is available to the person who owns the account, in Settings → Security and login.
- There is no second factor for a normal account and none for an administrator in this version. The panel says so where it would be, rather than leaving the gap to be discovered.
The one credential to change on day one
The administrator account created by the bootstrap command. Its password was chosen to get you in. Change it in Settings → Security and login before the installation has any users at all.