Skip to main content
People sign in through your own identity provider using single sign-on, so there is no separate password for this platform to store or for you to rotate. Access is provisioned on first sign-in, so there is no separate account-creation step to complete first.

​
Authentication

Opening the console sends you through your organization’s identity provider. On the way back, your browser holds a signed, short-lived session — nothing to configure, and no credentials held here.
Programmatic access does not use a session. Scripts, CI jobs, and integrations authenticate with an API key instead, and workers use their own agent credential.

​
Joining an account

There is no registration step. The first time you sign in, your access is resolved from one of two paths:
1

An invitation

A teammate invites you by email from Settings → Members. Your membership exists from that moment and becomes active the first time you sign in with that address — there is nothing to accept.
2

A trusted email domain

An account can trust a verified email domain. If one or more accounts trust yours, signing in joins you to all of them; you land in one and reach the rest from the account switcher.
If neither applies you can still sign in, but you hold no account access until you are invited. An invitation issued later takes effect on your next sign-in. The first person in a brand-new account becomes the account Owner, which holds every capability account-wide — so a fresh account can never be locked out. Everyone who joins afterwards holds whatever roles they are assigned, and an invitation can carry them.

​
Sessions

​
Next steps

Accounts & members

Managing the people in an account, and belonging to more than one.

Roles & permissions

What a member can actually do once they are in.

API keys

Access without a browser.

Audit log

Where membership changes and account switches are recorded.