# Sign-in and workspace access

Open the Amon Sul workspace address supplied by your administrator. You need an
invitation and an active account for that workspace; authentication alone does
not give access to product records or actions. There is no public signup.

## Sign-in screens

Amon Sul signs you in on its own screens at your workspace address. WorkOS handles the identity behind them: it checks
passwords and codes and sends the authentication emails. You never leave the
workspace address to sign in.

On the sign-in page, use the methods it offers:

| Method                       | What you do                                                                    |
| ---------------------------- | ------------------------------------------------------------------------------ |
| Password                     | Enter your account email and password                                          |
| Email code                   | Request a code and enter it on the same screen                                 |
| Enterprise Microsoft sign-in | Follow your organisation's Entra sign-in, when it is set up for this workspace |

An organisation can require enterprise sign-in. Then the screen sends you
straight to it and email sign-in is not offered. A WorkOS organisation or an
invitation alone does not turn on enterprise sign-in: an operator configures
the connection and policy for the workspace. Social sign-in is not offered.

## Accept an invitation

1. Open the invitation email and check that it names the workspace you expect.
2. The acceptance screen shows the invited email, which you cannot change.
   Request an email code and enter it in the same browser.
3. If you are new, set a password of at least 12 characters with a lowercase
   letter, an uppercase letter, a number and a symbol. If you already have one
   from another workspace, choose **I already have a password** and confirm it.
4. Complete any verification or additional security step the screen asks for.

If the email is wrong, ask the administrator for a corrected invitation. An
expired or revoked invitation cannot be accepted. Accepting an invitation does
not replace an existing account's password or grant access to other workspaces.

## Verification and additional security

Email verification and email sign-in use a code from WorkOS; enter it on the
active screen or use its resend action. Password confirmation asks for your
existing password before a protected step and grants nothing new.

When your organisation's policy requires multi-factor authentication, the
screen asks you to enrol an authenticator app and then enter its code at each
sign-in. An expired or failed code means starting again from the same workspace
address rather than reusing an old code.

## Recover a password

Choose **Forgot password**, enter your account email and follow the reset
message. The screen does not say whether an account exists for that email. The
reset link opens a screen where you set a new password under the same rules;
then sign in again. A reset does not sign you in or give workspace access.
Where email codes are offered, they let you sign in without a password.

## Authentication emails

WorkOS sends invitations, verification and sign-in codes and password resets.
Webhook, external-system and integration settings do not control these
messages.

## Shared identity and separate workspace access

Within one provider environment, Amon Sul and Fleetlane share one account: an
existing Fleetlane user invited to Amon Sul signs in with the same password.
Staging and production have separate identity pools.

Each workspace has its own WorkOS organisation. Membership is checked alongside
the local invited account, its active state and its roles. Signing in to one
workspace grants nothing in another, and browser sessions are bound to their
application and host. Recovering your password changes it for every workspace
that account belongs to.

## Administrator checks

Confirm the intended workspace, email, active local account, organisation
membership and role assignments. A person may authenticate and still lack
permission to enter the workspace or perform a particular action.
Use **Settings → Users & Access** for local users and roles. Lane selection
changes execution and integration context, not workspace membership. Machine API
keys are a separate form of access with their own scopes and lane; a browser
sign-in is not a machine API credential. See [screens and settings](https://docs.amonsul.io/guides/screens/)
and the [machine API](https://docs.amonsul.io/developers/api/).

## When sign-in or access fails

Check the exact workspace address, invited email and account state. For a
missing invitation or recovery message, check spam and organisation mail
filtering, then ask the administrator to review the invitation. A successful
sign-in followed by refused access needs membership and role checks; repeating
password resets will not assign that access.

For support, provide the workspace address, time, sign-in step and visible
message. Keep passwords, codes, invitation and reset links, session cookies and
authenticator secrets private.