Core concepts
Sign-in, without surprises.
Accounts, sessions and recovery live in the API and the dashboard. This site only hands over to them.
Where people sign in
Sign-in, sign-up and password recovery are pages of the dashboard, at /auth/signin, /auth/signup and /auth/forgot-password. The same addresses on this site send visitors there, in their language, with the query string kept.
Sign-up and onboarding
A new account asks for a name, an email, a password and acceptance of the terms, then continues to a three-step onboarding: the workspace (name, address and region), the team (invitations, which can be skipped) and a review. Creating the workspace makes the new account its owner.
Sessions
The API signs sessions with JWT_SECRET and keeps them for JWT_EXPIRATION. Remember me decides how long a session lasts; passwords are never stored in the browser. Sign-in attempts are limited per address with RATE_LIMIT_LOGIN, and every failed attempt gets the same message, whether or not the email exists.
Password recovery
Forgot password sends a reset link valid for a short time. The answer is the same for every address, so the form never reveals who has an account. With SMTP configured the link is emailed; without it, the API writes it to its log.