Skip to main content
People sign in through your own identity provider using single sign-on, so there is no separate password for this platform to store or for you to rotate. This page explains what happens on a first sign-in, how a session behaves once you have one, and the two ways someone comes to belong to a workspace.

​
Authentication

Opening the console sends you through your organization’s identity provider. On the way back, your browser holds a signed, short-lived session — nothing to configure, and no credentials held here.
Programmatic access does not use a session. Scripts, CI jobs, and integrations authenticate with an API key instead, and workers use their own agent credential.

​
Joining a workspace

There is no registration step. The first time you sign in, your access is resolved from one of two paths:
1

An invitation

A teammate invites you by email from Settings → Members. Your membership exists from that moment and becomes active the first time you sign in with that address — there is nothing to accept.
2

A trusted email domain

A workspace can trust a verified email domain. If one or more workspaces trust yours, signing in joins you to all of them; you land in one and reach the rest from the workspace switcher.
If neither applies you can still sign in, but you hold no workspace access until you are invited. An invitation issued later takes effect on your next sign-in. The first person in a brand-new workspace becomes the workspace Owner, which holds every capability workspace-wide — so a fresh workspace can never be locked out. Everyone who joins afterwards holds whatever roles they are assigned, and an invitation can carry them.

​
Sessions

​
Next steps

Accounts & members

Managing the people in a workspace, and belonging to more than one.

Roles & permissions

What a member can actually do once they are in.

API keys

Access without a browser.

Audit log

Where membership changes and workspace switches are recorded.