The dashboard can sign users in with Google and GitHub in addition to email and password.
What it does
| Action | With Google or GitHub |
|---|---|
| Sign in to an existing account | Yes |
| Accept a member invite | Yes |
| Create a new account and Company | Yes (one short completion screen) |
| Link / unlink providers, set a password | Settings → Sign-in methods |
- Existing account, same email. The first time someone signs in with a provider whose email matches an existing account, the provider is linked to that account - only when the provider says the email is verified (Google
email_verified, GitHub's verified primary email). Otherwise the sign-in is refused and the user is asked to sign in with their password. A password account whose email was never verified is not linked either: its owner signs in with the password and connects the provider in Settings, or resets the password. Each new link sends a security email to the account. - Pending invites. An invited user who has not accepted yet must open the invite link from their email; the invite screen offers Google and GitHub too, bound to that invite.
- Changing sign-in methods. Disconnecting a provider or setting a first password requires a sign-in within the last 15 minutes; otherwise the dashboard asks to confirm with a connected provider or the password. The last remaining method can't be removed. Links and unlinks are written to the Company audit log (
auth.identity.linked/auth.identity.unlinked). - Nothing from the provider is stored but the identity. Notti keeps the provider user ID and the email it reported. It never stores provider access or refresh tokens.