Your account

The sign-in page has the ways this instance allows. With your email and password, type both and choose Sign in. When root has turned on your company's identity provider, there's also a Continue with <name> button: it takes you to the provider, and back here signed in. The first time, if root allows your email's domain for that provider, Ronne links you to your account with the same email, or creates one (How it fits together). An account made this way has no password: you always sign in through the provider, which asks for its own second step. A sign-in through a provider lasts 24 hours at most, and ends when you close the browser; signing in again is usually one click.

When root allows password sign-in to root only, the buttons come first and the password form is behind Use your password (root): everyone else signs in with the provider, and rmk needs a token from CLI & tokens (Logging in).

If the provider sends you back with a message:

• You can't sign in here with that account. There's no account for your email and its domain isn't allowed; or there is one, but this provider can't link it (its domain isn't one the provider lists, linking is off, or the account is linked to someone else at that provider); or your address can't be used here (it isn't plain ASCII, it isn't a valid address, or Ronne's database compares it as equal to another account's address, which differs by accents, letter forms or invisible characters); or the account is disabled: ask root.
• Your identity provider didn't say your email is verified. Ronne needs that to trust the email: ask your company's administrator.
• The sign-in took too long, or was started in another browser. Start again from this page, in the same browser, within ten minutes.
• That provider didn't answer, or its answer couldn't be checked: try again, or use your password if you have one.
• That way of signing in isn't on. Root turned that provider off, or removed it, while you were signing in: use another way, or ask root.
• Too many attempts, wait a minute. More than 30 sign-ins with a provider were started from your network address in a minute (or, when this instance can't see network addresses, more than 300 from everyone together): try again a minute later. Your password still works meanwhile, if you have one.

What the instance holds about you is one JSON file away: Download my data on the Password tab (Your data).

Two-factor sign-in asks, after your password, for a 6-digit code from an authenticator app on your phone, so a stolen password alone doesn't open your account. Any app that reads a QR code for time-based codes works, such as Google Authenticator, Microsoft Authenticator, 1Password or Bitwarden. It's yours to turn on, unless a root requires it (below).

Turn it on under Account, on the Two-factor sign-in tab:

1. Type your password and choose Set up two-factor.
2. Scan the QR code with the app, or type the key under it into the app.
3. Type the code the app shows and choose Turn on. If a right-looking code is refused, check the phone's clock: the codes follow the time.
4. Save the ten backup codes (copy them or download them) and choose I've saved them. They're shown once and never again.

From then on, signing in asks for a code after your password. Type the one the app shows, or choose Use a backup code instead; each backup code works once. A code that was just used can't be used again: wait for the next one. Five wrong codes send you back to the password, and ten in a row lock the second step for 15 minutes. Remember me works as before.

• Backup codes. The tab says how many are left. Make new backup codes makes ten others, after your password; the old ones stop working.
• A new phone. Turn two-factor off (your password and a code, or a backup code), then on again with the new phone.
• A lost phone. Sign in with a backup code, then move to a new phone as above. With no backup code left, ask a root to reset your two-factor in Users; you then sign in with your password alone. A root with no other root runs reset-root-password on the server, which resets it too (Root accounts).
• When a root requires it. A root can require two-factor of reviewers (root, and the moderators and admins of shared workspaces) or of everyone (Settings). If it's required of you and you haven't set it up, every page opens this tab, with a notice saying why, until you do. You can still sign out.
• rmk. A password alone makes no token for an account with two-factor:rmk login says so and goes on in the browser, where you approve it (Signing in with the browser). A token made under CLI & tokens, with rmk login --token, works too.

Turning two-factor on or off and making new backup codes are recorded in the audit log, as are refused codes. An account with no password here, one that signs in only through a company identity provider, has nothing to set up: that provider asks for its own second step.