Signing In
There are three ways onto the platform: an invitation from someone who is already on it, self-serve signup with your email address, and single sign-on with Google or GitHub. Which of them you see depends on how your platform is configured.
One email, one account
An email address identifies exactly one account across the whole platform, and that account belongs to exactly one organization.
The practical consequences:
- You cannot hold two accounts under the same address, even in different organizations.
- If someone invites an address that already has an account elsewhere, the invitation is accepted by the system but no second account and no email are produced. Nothing tells the sender whether the address was already taken — that is deliberate, so an invite form cannot be used to discover who is on the platform.
- To move to a different organization, ask an administrator of your current one to transfer you rather than registering again.
Sign in with a password
Enter your email and password on the sign-in page.
Passwords are used exactly as typed — leading and trailing spaces are preserved. If sign-in fails unexpectedly, check for whitespace picked up from a copy-paste.
A failed sign-in always gives the same message regardless of why it failed. The platform never confirms whether an address exists, whether it has a password, or whether it was the password that was wrong.
If you created your account with Google or GitHub, you have no password to type. Use the provider button instead — the sign-in page says so beneath the provider block.
Sign in with Google or GitHub
If your platform administrator has configured single sign-on, a Continue with Google and/or Continue with GitHub button appears above the password form.
- Click the provider button. You are taken to the provider's own sign-in page.
- Approve the request there.
- You return to the portal signed in.
Only providers that an administrator has both enabled and validated appear. If none are configured, the buttons are simply absent and the password form is unaffected.
First time through SSO
If no account exists for the address the provider vouches for, signing in creates one, along with a new organization that you own. The organization gets a provisional name derived from your address — you are asked to replace it during onboarding.
If SSO refuses
The callback page names the reason rather than telling you to try again:
| What you see | What to do |
|---|---|
| Your provider account has no verified email address | Verify (or un-hide) an email address with the provider, then retry. A GitHub account with every address set to private hits this. |
| Your account is not active | The account exists but is suspended. Contact your administrator — retrying will not help. |
| Too many attempts | A per-address-range limit was reached, most likely because you share a network with other users. Wait and retry. |
| This provider isn't available | The provider is disabled or its configuration is not valid. Contact your administrator. |
Linking and unlinking providers
Your Profile page has a Linked accounts card. From there you can add Google or GitHub to an account you created with a password, or remove one you no longer use.
Two rules apply:
- The provider must vouch for your account's own email address, verified. Linking an account that carries a different address is refused, and the message names the address it expected.
- You cannot remove your only way in. If you have no password and one linked provider, the Unlink button is disabled and says why.
Self-serve signup
When your platform has self-serve signup switched on, the sign-in page carries a Sign up link.
- Enter your email address on
/signup. Nothing else is asked for at this stage. If your operator has published a privacy policy or terms, a single line beneath the field points at it — there is no checkbox here, because no account exists yet to attach an agreement to. - You get the same "check your email" confirmation whichever way the request resolved — the platform does not reveal whether the address is already registered.
- Open the link in the email and complete the form: your name, a password, and any agreements your operator has published. Submitting it creates your account and signs you in, so you carry straight on into the portal rather than passing back through the sign-in page.
Notes worth knowing before you start:
- The signup link is valid for 7 days and can be used once.
- Requesting signup again does not re-send the email. If you lose the message, wait out the 7 days or ask an administrator to invite you. This is deliberate: it means nobody else can invalidate a link that is already sitting in your mailbox by requesting one for your address.
- There is a per-address and per-network request limit. Exceeding it shows a countdown rather than a failure.
If self-serve signup is switched off for your platform, the Sign up link does not appear at all, and /signup says sign-up is not available rather than accepting an address and refusing it afterwards.
Accepting an invitation
An invitation email links to a page where you set your name and password. Submitting the form creates your account and signs you in: you continue straight to onboarding, or to the portal if there is nothing left to complete. You never have to return to the sign-in page and re-enter the password you have just chosen.
Names accept letters (including the full Turkish alphabet), spaces, hyphens and apostrophes, up to 50 characters. Digits, dots and other punctuation are refused — a trailing dot on a surname is the common case. The rule is checked before the form is submitted and the offending field is flagged inline.
Password requirements are shown on the form as a live checklist. See Profile → Password for the full policy.
If your platform operator has published agreements — a privacy policy, terms of service, a marketing opt-in — they appear as checkboxes above the submit button. Required ones carry a red asterisk and block the submit until they are ticked; the message names each box that still needs you ("Please accept this to continue.") and a line under the form says how many are outstanding. Nothing is sent and the invitation link is not consumed, so you can tick the box and submit the same form again. See Legal Agreements.
If the link itself is the problem — already used, expired, or truncated by your mail client — the page says so ("Invalid or expired invite token") instead of showing a generic failure.
Opening an invitation link in a browser that is already signed in as somebody else still shows the invitation form, rather than dropping you into the account that browser was already using. Accepting it there signs that browser in as the new account.
If your operator republishes an agreement
An operator can publish a new version of an agreement and require existing users to accept it. When that happens you are stopped on your next sign-in — or your next page, if you are already signed in — by a single screen headed "Please review our updated terms", carrying every outstanding agreement at once.
Accept and continue records them and returns you to the page you were heading for. There is no way past the screen other than accepting or Sign out instead; typing a portal URL directly lands you back on it. If you also have onboarding outstanding, onboarding comes first.
Optional agreements never hold you up this way. Full detail in Legal Agreements.
Signing out
Log Out in the account menu ends only the device you are using. Your other browsers and devices stay signed in.
To end every other session, use Sign out everywhere on your Profile page. That page also lists each active session individually so you can revoke one at a time.
Revocation takes effect immediately. A signed-out session's access token stops working on its very next request, not when it would otherwise have expired.