--- title: "Signing in" slug: account/sign-in url: https://projectri.com/docs/account/sign-in section: account audience: everyone app_route: "/login" mobile: "/login" updated: 2026-09-08 source: Projectri documentation --- # Signing in Every way into Projectri — password, emailed code, Google, single sign-on and linking from a device you already trust — and what each refusal means. ![Signing in](https://projectri.com/docs-shots/account-sign-in.png) ## What it is `/login` is the one door into the workspace. It handles signing in, creating an account, answering a two-factor challenge, choosing between workspaces and linking a new device — all on the same card, one pane at a time. ## How to get there Go to `/login`. Anything in the app you open without a session sends you here with a `next` parameter, and you are returned to that exact page afterwards. No permission or plan is involved. ## How to use it ### Sign in with a password 1. Type your email address. Wait a moment before reaching for the password box — once the address looks complete, Projectri asks whether your workspace uses single sign-on, and a **Continue with …** button appears if it does. 2. Type your password and press **Sign in**. 3. If your workspace *requires* single sign-on, the password box disappears after the first attempt and only the SSO button remains. The credential was not wrong; the workspace does not accept it. ### Sign in with a code instead 1. Choose **Sign in with a code** under the divider. 2. Enter your email and press **Send code**. A six-digit code is emailed and is good for **10 minutes**. 3. Type it in. **Resend** is available after a 60-second cooldown. ### Sign in with Google Press **Continue with Google**. Your Google account's email must be verified, and it has to match an account that already exists here. ### Link from a device you already trust 1. Choose **Link from a device you're already signed in on**. 2. This browser draws a QR code and an eight-character code. Scan or type it on a phone that is already signed in *and* already approved for encrypted messages. 3. You are signed in with no password typed, and this browser holds every conversation key. The code dies after **two minutes** and when you leave the screen. See [Linked devices](/docs/account/linked-devices). ### Answer a two-factor challenge 1. If your account holds an authenticator, the six-digit box appears after the password is accepted. Nothing is signed in yet at this point. 2. Enter the code from your authenticator app, or choose **Use a recovery code** if that option is offered — it only appears when you have codes left to spend. 3. Leaving this pane cancels the sign-in and returns you to the password box. The challenge itself lives for **five minutes** and allows **five** wrong answers before it dies. ### Choose a workspace If you belong to more than one workspace, a list appears after your identity is proven. Each row shows the workspace name and your role in it. Sandboxes are never listed here — a sandbox is entered deliberately from inside its parent workspace. ### Create an account 1. Press **Sign up**. 2. Give a name, email and password. The minimum is eight characters, or your workspace's own rule if you already have a pending invitation to one. 3. A six-digit code is emailed. Enter it, and you are taken to [onboarding](/docs/account/onboarding). ## What it affects - **Signing in creates a session row**, which appears in **Settings → Security → Active sessions** on every one of your devices, with its label, its platform and when it was last used. - **One session per platform.** One browser, one iPhone, one Android. Signing in when one of them is already taken produces a dialog naming the other device and when it was last used, and continuing signs that one out. Linked devices are counted separately and never conflict with an ordinary sign-in. - **Ending a session never touches encryption keys.** A device that is signed out keeps every key it held, and gets them back on the next sign-in. - **Every attempt is recorded**, successful or not, and appears on the workspace's Security Centre. That record is also what the lock-out counter reads. - **Changing your password ends your other sessions.** The toast says how many. ## On mobile The Expo app's sign-in screen takes an email and a password, and offers the same emailed-code path and the same **link this device** path. A two-factor challenge and the workspace picker are their own screens. Google sign-in and single sign-on are not offered in the app. ## Limits and gotchas - **Too many failed attempts locks the address, not the account.** By default it is **10 failures within 15 minutes**, and both numbers are set per workspace on the Security Centre. The refusal says how many minutes are left. It is keyed on the email address, so guessing addresses is throttled too. - *"This device was signed out. Sign in again to continue."* means the session was revoked from somewhere else — another device, or an administrator. It is not a crash. - *"Please verify your email"* moves you to the verification step rather than refusing. The code is the same six-digit kind and lasts 10 minutes. - *"This account has been locked"* is a platform-level lock and names the reason your administrator gave. No password will get past it. - A wrong password and an address that does not exist give the same answer, on purpose. Neither tells you which. - If you hold an authenticator but your workspace has just started requiring one and your grace period has ended, sign-in is refused with a message saying so — enrol from a device that is still signed in, or ask an administrator. > [!WARNING] > If you are told you are signed in on a device you do not recognise, cancel > rather than continuing, and change your password. Signing that session out > would not be enough on its own. ## Related - [Two-factor authentication](/docs/account/mfa) — enrolling, recovery codes, and what a workspace can require. - [Linked devices](/docs/account/linked-devices) — signing in by scanning a code. - [Accepting an invitation](/docs/account/invites) — arriving from an emailed link. - [Setting up your workspace](/docs/account/onboarding) — what happens after a new account is verified. ## Related - [Two-factor authentication](https://projectri.com/docs/account/mfa.md): Enrolling an authenticator, recovery codes, what a workspace can require, and how to get back in when the phone is gone. - [Linked devices and encryption keys](https://projectri.com/docs/account/linked-devices.md): How a new device is trusted to read encrypted messages, how to sign in by scanning a code instead of typing a password, and what unlinking actually removes. - [Setting up your workspace](https://projectri.com/docs/account/onboarding.md): The five-step setup a new workspace runs once — name and URL, country and currency, your role, and a starting template. - [Accepting an invitation](https://projectri.com/docs/account/invites.md): What the join link does, why it insists on the address it was sent to, and what happens the moment you accept. - [The mobile app](https://projectri.com/docs/account/mobile-app.md): What the iOS and Android apps do, how to sign in, App Lock, push notifications, and what still works with no signal.