Accounts, sign-in and organizations

Sign in

The console root (/) has no screen of its own — it redirects straight to /dashboard.

/login takes an email and a password. The API's better-auth configuration is email-and-password only — there is no magic link, no one-time code and no passwordless flow. The page also links to Create account, Forgot password and a support mailto.

When a deployment has OAuth or OIDC configured, matching buttons appear automatically, driven by the public security.authProviders procedure: a Continue with {name} button for a generic OIDC provider, plus Google and GitHub when GOOGLE_CLIENT_ID / GITHUB_CLIENT_ID are set. A deployment with none of them shows only the password form.

A ?next= parameter is honoured after a successful sign-in, but only for a same-origin path — an absolute URL to another host is discarded.

Register

/register asks for name, email, password and confirmation. The password must be at least 15 characters ("At least 15 characters." is shown under the field) and the confirmation must match; validation runs both on blur and as a focusable error summary when the form is submitted. A required checkbox links to the Terms and Privacy pages on the marketing site. The same conditional OIDC / Google / GitHub buttons as on sign-in appear when the deployment has them, and a same-origin ?next= is honoured after signing up.

Signing up signs the user in and continues to the ?next target — Overview by default. /verify-email is not part of that redirect: it is the address the API's verification email points at, and email verification is not required to use the account.

Verify your email

/verify-email has three outcomes:

• Email confirmed — the token was accepted. A Continue to dashboard button follows.
• This link no longer works — the token is missing, already used or expired.
• Something went wrong — any other failure, with the option to sign in.

Unverified members can ask for a new message from Profile — the banner there offers Resend verification email.

Reset a password

/forgot-password accepts an email address and always shows the same confirmation, whether or not an account exists — a deliberate anti-enumeration choice. Only operational failures (rate limiting, a disabled feature, the network) surface as errors. The confirmation offers Try again to return to the form, its sign-in link carries any ?next= through, and the email links to /reset-password?token=…. The link expires in one hour.

/reset-password reads the token and any error code from the query string that the API's redirect set. An expired token is described differently from an invalid or already-used one. The new password must be 15–128 characters and match its confirmation. Success shows "Password updated" with Continue to sign in; an unusable link offers Request a new link, which goes back to the forgot-password form.

Accept an invitation

An organization owner or admin invites a colleague from Team. The invitation email links to /invitation/{id}, which shows the organization name, who invited you, the role you are being offered and the expiry date, with Accept and Decline.

A visitor who is not signed in is sent to sign in first and returned to the invitation. The page distinguishes four load outcomes:

Accepting adds you to the organization and makes it active. Declining marks the invitation rejected, and an invitation the sender withdrew shows as canceled; all three are terminal states shown in place of the card.

Create an organization

An organization owns an engine, its collections, API keys and team. The console sends an anonymous visitor to sign in before /create-organization and offers a form with:

• Name — free text.
• Slug — auto-derived from the name until you edit it yourself. It must match ^[a-z0-9]+(?:-[a-z0-9]+)*$, is checked for availability with a debounced request, and is used in URLs and API responses.

The create button stays disabled until the name is present and the slug is free. The organization becomes active and the console opens on Overview. A signed-in user who already belongs to an organization also gets a "Changed your mind? Back to the dashboard" link.

Switch organizations

The switcher at the top of the sidebar lists every organization you belong to and shows the active one. Choosing another changes what every screen reads and writes; the console refreshes in place. The same menu links to organization Settings and to New organization.

Without an active organization, screens that need one either show an empty state pointing back to Overview or refuse the action — control-plane and tenant calls both resolve the organization from the session.

Quick start

/dashboard/quick-start is the new-organization checklist. It is described in full on the Console overview; its steps are:

The checklist reads live state on focus, so steps tick themselves off as the work happens elsewhere; the optional ones you confirm yourself and they are remembered in the browser.

Session lifetime

The console uses the API's better-auth session cookie. The dashboard layout redirects an anonymous visitor to /login?next=…, and the proxy layer enforces the same gate on /dashboard/** and /create-organization before a page is rendered. Sessions can be listed and revoked from Profile → Security; an organization can also cap the maximum session age and restrict console access by IP in Settings → Security.

Help, status and maintenance

The sidebar's support block links to this documentation, the API reference and a support email. /maintenance is a static "we'll be back shortly" page with links to the status page and support — nothing redirects into it automatically, so it is only served when the deployment routes traffic there. An unknown console URL answers the console's own 404 with a link back to the dashboard and the support address.

Next

• Data and indexing
• Organization and billing