Sign-in and workspace access
Open the Amon Sul workspace address supplied by your administrator. You need an invitation and an active account for that workspace; authentication alone does not give access to product records or actions. There is no public signup.
Sign-in screens
Section titled “Sign-in screens”Amon Sul signs you in on its own screens at your workspace address. WorkOS handles the identity behind them: it checks passwords and codes and sends the authentication emails. You never leave the workspace address to sign in.
On the sign-in page, use the methods it offers:
| Method | What you do |
|---|---|
| Password | Enter your account email and password |
| Email code | Request a code and enter it on the same screen |
| Enterprise Microsoft sign-in | Follow your organisation’s Entra sign-in, when it is set up for this workspace |
An organisation can require enterprise sign-in. Then the screen sends you straight to it and email sign-in is not offered. A WorkOS organisation or an invitation alone does not turn on enterprise sign-in: an operator configures the connection and policy for the workspace. Social sign-in is not offered.
Accept an invitation
Section titled “Accept an invitation”- Open the invitation email and check that it names the workspace you expect.
- The acceptance screen shows the invited email, which you cannot change. Request an email code and enter it in the same browser.
- If you are new, set a password of at least 12 characters with a lowercase letter, an uppercase letter, a number and a symbol. If you already have one from another workspace, choose I already have a password and confirm it.
- Complete any verification or additional security step the screen asks for.
If the email is wrong, ask the administrator for a corrected invitation. An expired or revoked invitation cannot be accepted. Accepting an invitation does not replace an existing account’s password or grant access to other workspaces.
Verification and additional security
Section titled “Verification and additional security”Email verification and email sign-in use a code from WorkOS; enter it on the active screen or use its resend action. Password confirmation asks for your existing password before a protected step and grants nothing new.
When your organisation’s policy requires multi-factor authentication, the screen asks you to enrol an authenticator app and then enter its code at each sign-in. An expired or failed code means starting again from the same workspace address rather than reusing an old code.
Recover a password
Section titled “Recover a password”Choose Forgot password, enter your account email and follow the reset message. The screen does not say whether an account exists for that email. The reset link opens a screen where you set a new password under the same rules; then sign in again. A reset does not sign you in or give workspace access. Where email codes are offered, they let you sign in without a password.
Authentication emails
Section titled “Authentication emails”WorkOS sends invitations, verification and sign-in codes and password resets. Webhook, external-system and integration settings do not control these messages.
Shared identity and separate workspace access
Section titled “Shared identity and separate workspace access”Within one provider environment, Amon Sul and Fleetlane share one account: an existing Fleetlane user invited to Amon Sul signs in with the same password. Staging and production have separate identity pools.
Each workspace has its own WorkOS organisation. Membership is checked alongside the local invited account, its active state and its roles. Signing in to one workspace grants nothing in another, and browser sessions are bound to their application and host. Recovering your password changes it for every workspace that account belongs to.
Administrator checks
Section titled “Administrator checks”Confirm the intended workspace, email, active local account, organisation membership and role assignments. A person may authenticate and still lack permission to enter the workspace or perform a particular action. Use Settings → Users & Access for local users and roles. Lane selection changes execution and integration context, not workspace membership. Machine API keys are a separate form of access with their own scopes and lane; a browser sign-in is not a machine API credential. See screens and settings and the machine API.
When sign-in or access fails
Section titled “When sign-in or access fails”Check the exact workspace address, invited email and account state. For a missing invitation or recovery message, check spam and organisation mail filtering, then ask the administrator to review the invitation. A successful sign-in followed by refused access needs membership and role checks; repeating password resets will not assign that access.
For support, provide the workspace address, time, sign-in step and visible message. Keep passwords, codes, invitation and reset links, session cookies and authenticator secrets private.