> ## Documentation Index
> Fetch the complete documentation index at: https://docs.komodor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Signing in

> How people authenticate through your identity provider, how a session behaves, and how someone comes to belong to a workspace.

People sign in through your own identity provider using single sign-on, so there is no separate
password for this platform to store or for you to rotate. This page explains what happens on a
first sign-in, how a session behaves once you have one, and the two ways someone comes to belong to
a workspace.

## Authentication

Opening the console sends you through your organization's identity provider. On the way back, your
browser holds a signed, short-lived session — nothing to configure, and no credentials held here.

<Note>
  Programmatic access does not use a session. Scripts, CI jobs, and integrations authenticate with an
  [API key](/security-and-governance/identity-and-access/api-keys) instead, and workers use their own
  [agent credential](/security-and-governance/identity-and-access/agent-identity).
</Note>

## Joining a workspace

There is no registration step. The first time you sign in, your access is resolved from one of two
paths:

<Steps>
  <Step title="An invitation">
    A teammate invites you by email from **Settings → Members**. Your membership exists from that
    moment and becomes active the first time you sign in with that address — there is nothing to
    accept.
  </Step>

  <Step title="A trusted email domain">
    A workspace can trust a verified email domain. If one or more workspaces trust yours, signing in
    joins you to all of them; you land in one and reach the rest from the workspace switcher.
  </Step>
</Steps>

If neither applies you can still sign in, but you hold no workspace access until you are invited.
An invitation issued later takes effect on your next sign-in.

The **first person in a brand-new workspace** becomes the workspace **Owner**, which holds every
capability workspace-wide — so a fresh workspace can never be locked out. Everyone who joins
afterwards holds whatever roles they are assigned, and an invitation can carry them.

## Sessions

| Behavior        | What to expect                                                                                                                                                                    |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Lifetime**    | A session lasts up to 24 hours. When it expires it is renewed silently against your identity provider's longer-lived session — you only see a login screen when that is gone too. |
| **Signing out** | Ends both this session and your identity provider's session in that browser, so you are not signed straight back in.                                                              |
| **Suspension**  | If your membership is suspended, your existing session stops working on its next request rather than lasting out the day.                                                         |

## Next steps

<CardGroup cols={2}>
  <Card title="Accounts & members" href="/security-and-governance/identity-and-access/accounts-members">
    Managing the people in a workspace, and belonging to more than one.
  </Card>

  <Card title="Roles & permissions" href="/security-and-governance/identity-and-access/roles-permissions">
    What a member can actually do once they are in.
  </Card>

  <Card title="API keys" href="/security-and-governance/identity-and-access/api-keys">
    Access without a browser.
  </Card>

  <Card title="Audit log" href="/security-and-governance/controls/audit-log">
    Where membership changes and workspace switches are recorded.
  </Card>
</CardGroup>


## Related topics

- [Outbound webhooks](/manage-your-agents/run/outbound-webhooks.md)
- [Overview](/get-started/overview.md)
- [How it works](/security-and-governance/how-it-works.md)
- [Interfaces](/get-started/interfaces.md)
- [Accounts & members](/security-and-governance/identity-and-access/accounts-members.md)