Passwords & signing in

You sign in to OrderDen with your email address and a password, or with Google where the server offers it. There are no usernames: the address you signed up with is your identity, so the only thing to recover is the password.

Signing in with Google

Where the server offers it, Sign in with Google is at the top of the sign-up and sign-in pages, above an or line that separates it from the email form. Use one or the other: Google, or your email address and a password.

• New to OrderDen. The account is made from your Google address. Google has already checked that the address reaches you, so there's no confirmation email; you go straight to setting up your workspace.
• You already have an OrderDen account on that address. Google signs you into it, and both ways in work from then on.
• You have an account on that address but never confirmed it. Google is refused, and the sign-in page says so. Confirm the address first, by following the link we emailed when the account was made (the confirmation page has Send the link again), and Google works after that. Until an address is confirmed, the account isn't proof that whoever made it reads that inbox, and letting Google into it could open someone else's workspace.
• Google says your address is unverified. Refused too, for the same reason. Sort it out with Google, or use a password.

Choosing a password

Between 8 and 128 characters, and you type it twice wherever you set one: at signup, on the reset page, and in Personal Settings → Security → Password. The two are compared on the server, so a mismatch never gets through.

Length matters more than cleverness. A phrase you can remember and nobody else would guess is better than a short one full of punctuation, and a password manager's generated one is better still.

Forgotten password

1. On the sign-in page, follow Forgot your password?
2. Type the email address you sign in with and press Email me a link.
3. The page answers "If that address has an account, we have sent a link to reset the password." It says the same either way, so the page can't be used to find out who has an account.
4. Open the email and follow the link. Type the new password twice, and you're taken to the sign-in page to use it.

The link works once and expires an hour after it's sent. An old link, or one clicked twice, lands on a page that says so and offers to email a new one. Asking for a link doesn't change your password, so an unexpected reset email is safe to ignore.

Setting a new password signs out every device, so if someone else had the old password, their session ends too. You'll sign in again on your phone and anywhere else you were signed in.

The reset shows in the activity trail ("…reset their password") of every workspace you belong to. Asking for a link isn't recorded anywhere a workspace can see, because the person asking hasn't proved who they are.

If you signed up with Google

That kind of account has no password, so there's nothing to reset. Use Sign in with Google instead; the reset page says so under the form. If you ask for a link anyway, the email you get says the same, rather than sending you to set a password you'd never use. Only the inbox learns which accounts have passwords.

If nothing arrives

• Check the spam folder. The email comes from OrderDen itself, not your workspace's mail server.
• Make sure you typed the address you signed up with. The email only goes to an address that has an account, and the page reads the same either way.
• Too many reset links have been requested for that address means 3 links in 15 minutes is the limit for one address. There's also a limit of 10 requests an hour from one place, whatever addresses are typed, with its own message. Wait and try again.

Changing a password you know

Personal Settings → Security → Password: type your Current password, then the New password twice, and press Change password. It signs out your other devices. Unlike a reset, it isn't recorded in the activity trail.

Second factors, passkeys and your signed-in devices are on the same page, and explained in Roles, permissions, two-factor and sessions.

Two-factor authentication

A password is something you know. Two-factor authentication adds something you have, so a leaked password isn't enough on its own. If your workspace holds client addresses and money, it's worth the two minutes: set it up.

It applies to Sign in with Google as well as to a password.