Sign in with email, Google or GitHub

What it is

The sign-in card at /login has two tabs, Sign in and Create account. Above them, Continue with Google and Continue with GitHub appear only when the server has that provider configured; the list comes from /api/auth/me, so the buttons cannot drift from what works. The same card sits on the landing page, and signing in there swaps straight into the editor without a page load.

How it works

Email accounts store a salted scrypt hash of the password, never the password. A new account gets the sample documents and a verification email. AI features stay locked until the link is clicked, and the yellow banner in the editor offers Resend link.

OAuth is a plain authorization-code flow. Runic sets a one-shot state cookie for ten minutes, sends you to the provider, and on return checks the state, exchanges the code and fetches your profile. Only a provider-verified email counts; an unverified address is refused with a message on the sign-in page. If that identity is already bound to an account, you are signed in. If not, Runic matches your verified email against existing accounts and links the identity to the match, verifying the account in passing. Otherwise a new account is created: verified from the start, seeded with samples, and marked as having no password.

A successful sign-in creates a session: a random token stored hashed in the database and set as the runic_session cookie, httpOnly, SameSite=Lax, Secure in production, 30 days. Sign out deletes the row and the cookie.

Connected accounts

Open the avatar menu and choose Connected accounts. Each configured provider shows a Connected badge with a Disconnect button, or a Connect link that starts the OAuth flow with link intent, attaching the identity to the account you are already in. If that identity belongs to a different Runic account, you come back to the toast "That identity is already connected to a different Runic account." Disconnect refuses to remove your last way in: with no password set and no other provider, the server answers that this is your only way to sign in and to set a password first. The footer of the modal tells you whether password sign-in is enabled.

Password reset and lockout

Forgot password? on the Sign in tab asks for your email and always answers the same way, so whether an account exists is not observable. The emailed link opens /reset, works once and expires in 2 hours. Setting a new password signs you in on that device, clears any login lock and revokes every other session. Four wrong passwords within ten minutes lock that email for fifteen minutes, keyed to your IP and email together, so someone guessing at your address from elsewhere cannot lock you out.

Limits

Passwords need 8 to 200 characters with at least one letter and one number. Per IP: 20 login attempts per 10 minutes, 5 signups per hour, 5 reset requests per hour, 30 OAuth starts per hour. Per email: 4 reset emails per hour. Accounts born from Google or GitHub have no password until you set one through Forgot password?; deleting the account also asks for a password, so set one first if you only sign in with a provider. A suspended account is refused at sign-in and loses every session.

How to use it

1. 1
   Open the sign-in card

   Click "Sign in" in the landing page header or go to /login. Pick the "Sign in" or "Create account" tab; /login?mode=signup opens the second one directly.
2. 2
   Use a provider

   Click "Continue with Google" or "Continue with GitHub". You return to the editor signed in. If the email is new, an account is created; if it matches an existing account, the provider is linked to it.
3. 3
   Or use email

   Create account: fill Name, Email and Password (at least 8 characters, a letter and a number) and press "Create account". Sign in: Email and Password, then "Sign in".
4. 4
   Verify your email

   New email accounts see the banner "Verify your email — we sent a link to …". Click the link in the mail, or "Resend link" on the banner. "I've verified" reloads the page.
5. 5
   Link or unlink a provider

   Click your avatar and choose "Connected accounts". Press "Connect" next to Google or GitHub to attach it, or "Disconnect" to remove it. The last way in cannot be removed.
6. 6
   Reset a password

   On the Sign in tab click "Forgot password?", enter your email and press "Email me a reset link". Open the link, type the new password twice and press "Set the new password".
7. 7
   Sign out

   Click your avatar and choose "Sign out". The session row and cookie are deleted.

Commands & shortcuts

Tips

• Signed up with Google and want a password too? Use Forgot password? with the same email; the link sets one and switches password sign-in on.
• Use the same email at Google or GitHub as on your Runic account and the first provider sign-in links to it. No duplicate account is created.
• GitHub must have a verified email on your profile; Runic reads the verified primary from the emails endpoint and refuses unverified ones.
• Resetting your password signs out every other device. Use it if you think a session was left open somewhere.

Questions