opsen has no passwords. Sign in with whichever of these your team uses:
| Method | Best for | What it proves |
|---|---|---|
| GitHub | Teams on GitHub | Who you are, and which organisations you own |
| Anyone with a Google account | Your email address | |
| GitLab | Teams on GitLab.com or a GitLab instance | Your GitLab account and verified email |
| Microsoft | Microsoft work and personal accounts | Your Microsoft account |
| Single sign-on | Companies on Okta, Entra ID, Google Workspace or any SAML or OIDC provider | Your company account. See Single sign-on |
| Email code | Everyone else | That you can read mail sent to that address |
Each method appears on the sign-in page when it is set up on this deployment.
One account
Every method opens the same account. Your account (the name at the bottom of the sidebar) lists the ways you can sign in and links new ones. A new method links to your account when you are signed in, or when the provider vouches for an email address your account already has. You can remove a method as long as one is left.
Microsoft lets the administrator of any tenant type any email address on an account, so opsen ignores the email on a Microsoft work account unless Microsoft marks the domain as verified. That account signs in, but never takes over another account with the same address.
What signing in does not do
Signing in proves who you are, not what you may change:
- GitHub organisations. Owner rights come only from GitHub, checked when you sign in and at least hourly. Link GitHub to open the organisations you own.
- Workspaces. You see a workspace when you created it, an owner invited your address, or its single sign-on let you in, with the role they chose.
- Single sign-on required. If a workspace requires it, you sign in through its provider as well, whichever method you used first.
Email codes
The code has six digits, works once and for ten minutes. Five wrong guesses and it stops working; ask for a new one. An address gets at most five codes an hour. The link in the email fills the code in on the sign-in page and still asks you to press Sign in, so a mail scanner that opens links signs nobody in.