The login settings decide who can become a member on their own and which ways there are to sign in. A closed platform suits courses you sell or members you invite. An open one lets anyone with the address join.
Opening registration
Registration is off in a new workspace. As long as it stays off, the sign-up page sends visitors to the login page, and the login page shows no link to sign up.
Turn on Enable registration page under Registration to let people join. Edit design then appears next to the switch and leads to the look of the login and registration pages.
What people fill in
The registration page asks for first name, last name, email address and a password, typed twice. The password needs at least 12 characters and must not appear in a known data leak. An email address that already has an account in your workspace is refused.
If you have set up terms or a privacy policy under Settings > Legal, a consent checkbox appears and must be ticked. Each acceptance is stored with the document version and the IP address.
After signing up, the new member lands on the login page and signs in with the new password.
A registration form for your own website
The Registration form tab gives you a code snippet for your own website, so visitors can join without leaving your page. Copy it with Copy code under Code for your website. Design changes apply right away, and the code stays the same.
The form asks for first name, last name and email address, plus the consent checkbox when your legal documents require it. There is no password field: new members always get an email to set their password. Under After sign-up you choose between Show confirmation and Open a page, which sends people to the Page address you enter.
The form follows the same switch as the registration page. While registration is off, it shows a notice instead of the fields. It also refuses new sign-ups once your plan's member limit is reached.
If someone enters an email that already belongs to a member, no second account is created. The member gets a sign-in link by email instead, valid for 15 minutes and sent at most once every 10 minutes.
Sign-in with Google
Google is the only social sign-in for members. Turn on Allow sign-in with Google under Sign-in with Google, and the login page shows a Google button. It is off by default.
A member is signed in when the verified email of their Google account matches their member profile. Google accounts without a verified email are refused. When the registration page is on, a first Google sign-in with a new email also creates a member. When it is off, unknown emails are turned away.
For coaching businesses we recommend keeping Google sign-in off. Participants who signed up with a different email than their Google account can get confused, which means more support requests.
Two-factor authentication
Every member and every team member can protect their own account. They open My Profile > Security, find Two-factor authentication and choose Authenticator app or Email codes. After the password, the login then asks for a six-digit code. An emailed code is valid for 10 minutes. Setup ends with eight recovery codes for the case that the phone or mailbox is out of reach. Sign-in with Google asks for the code too. Single Sign-On does not.
The workspace owner can make two-factor authentication mandatory for owner and admin accounts under Settings > Team & Roles.
Roles and permissions for your team
Single Sign-On from your own system
If your members already log in to a system of yours, Single Sign-On sends them straight into their member area without a second login.
- Click Generate secret and copy the signing secret. It is shown only once.
- Your system builds a JSON payload with the member's
email, a stableexternal_id, a randomnonceof at least 8 characters and an expiry timeexp, kept under 10 minutes ahead. It encodes the payload as base64url. Each nonce works only once. - It signs the encoded payload with HMAC-SHA256 and the secret, then sends
the member to the Login endpoint shown on the page, with
payloadandsigas query parameters. The endpoint ends in/sso/loginon your primary domain. - Turn on the switch next to the status. It stays locked until a secret exists.
With Provision new members, which is on by default, an unknown email
creates a member on the first sign-in. An email that already belongs to an
account in another workspace is refused. Turn it off to let only existing
members in. An optional return_to path picks the landing page. Without it,
members land on their dashboard.
Rotate secret stops the old secret immediately after you confirm, so update your system right away. Accounts with admin access can never sign in through Single Sign-On.
Who can change these settings
All settings pages require the Update Platform Settings permission. Saving the login settings also needs Manage Platform Design, and Single Sign-On needs Manage API Keys.