Authentication Screens

Reference for the screens involved in signing in and account verification.

Note

Password rule (shared across screens): 8–128 characters including at least one letter and one digit. A CAPTCHA may appear on the login and signup screens as an anti-abuse measure.

Login (/login)

Field	Type	Required	Notes
Email address	email	✓
Password	password	✓

• Continue with Google / GitHub: social login. Only enabled providers are shown
• Log in: on success you are taken to the dashboard. Users with MFA enabled proceed to the two-factor screen; users whose team requires MFA but haven’t set it up proceed to the MFA setup screen

Common errors:

Message	Cause
Incorrect email address or password	Wrong credentials
Too many login attempts; try again later	Lockout after repeated failures
Account is pending deletion; contact support to cancel	Account in the deletion process
Password reset required	The account requires a password reset

Signup (/signup)

Field	Type	Required	Notes
Name	text	–	1–100 characters if provided
Email address	email	✓
Password	password	✓	8–128 chars with letters and digits
Terms agreement	checkbox	✓	The signup button stays disabled until checked

On success you are taken straight to the dashboard. Signing up with Google / GitHub is also supported.

Forgot Password (/forgot-password)

Enter your email address and press “Send reset link” to receive a reset link by email. For security, the same completion message is shown whether or not an account exists for the address. Check your spam folder if the email doesn’t arrive.

Reset Password (/reset-password)

Opened from the link in the reset email. Enter a new password (8–128 characters) twice. A mismatch shows “Passwords do not match.” If the link is invalid or expired, an error screen appears and you can request a new link from “Forgot Password”.

Email Verification (/verify-email)

Opening the link from the verification email verifies the token automatically. Both success and failure show a result screen with a link back to the dashboard. Expired links fail verification.

Two-Factor Challenge (/mfa-challenge)

Shown at login for users with MFA enabled.

• Authenticator code: 6 digits; submits automatically once 6 digits are entered
• Recovery code: fallback when the authenticator app is unavailable; switch via “Use a recovery code”
• If the session expires, “MFA token expired; please log in again” is shown and you return to the login screen

MFA Setup Required (/mfa-setup-required)

Shown when your team policy requires MFA but you haven’t set it up. Either complete the setup dialog (“Set up two-factor authentication”: scan the QR code → enter the confirmation code → save recovery codes) or log out.

Device Authorization (/auth/device)

Approves a code shown by the CLI or MCP Server login and issues an API key. If you are not logged in, you are redirected to the login screen first.

Field	Type	Required	Notes
Authorization code	text	✓	XXXX-XXXX format; formatted automatically as you type
Confirmation checkbox	checkbox	✓	Confirms you initiated the login yourself

Caution

Approving a code issues an API key that gives external tools access to your team’s data. Never approve a code you did not generate yourself.

Common errors:

Message	Cause
Too many attempts	Repeated wrong input; log in again from the CLI
API key limit reached	Plan limit; delete unused keys and retry
Code not found	Typo in the code
Code invalid or expired	The code expired

Invitation Acceptance (/invite/:token)

Opened from a team invitation link. Shows the team name, inviter, and role.

• Logged in: join with the “Join {team}” button
• Not logged in: enter name (optional), email, and password, then “Create an account and join”
• Invitation links are valid for 7 days. Expired or used links show “Invalid invitation”

OAuth Callback (/auth/oauth/callback)

An intermediate screen processed automatically after Google / GitHub authentication. First-time users are asked to agree to the terms of service. On error, the reason is shown (cancelled, session expired, verified email required, already linked to another user, etc.) with a link back to login.