# Sign-in

People sign in with Siftware single sign-on, Google, GitHub or Apple, or with an email sign-in link. The app
has no password of its own, so a leaver is shut out by switching off their account at the provider.

## What you can do

- Sign in with single sign-on (Authentik), Google, GitHub or Apple. Google, GitHub and Apple are logo
  buttons on one line.
- Sign in with an email link. The link is for sign-in only: it does not create an account.
- Sign out from the user menu.
- Sign the iPhone app in with the same account.

## How to

1. Open the app and choose a method on the sign-in page.
2. For an email link, enter the address, open the email and press the button on the page it leads to.
   Opening the link alone signs no one in.
3. The app opens on the dashboard, or on the first screen the person can use.
4. To sign out, open the user menu at the foot of the sidebar and press Logout.

## Limits

- An account must exist first. An administrator adds staff on the Team screen; a client contact's login is
  set up separately. An unknown address gets no account, and no link is mailed to it.
- If a verified address already has an account, signing up with another method is refused with "You already
  have an account" and that account's sign-in methods, which are also emailed to it.
- On a first sign-in the app matches the account by email, once. After that it matches the provider's own id.
- Archived accounts and bots cannot sign in.
- Sign-ins, sign-outs and failed sign-ins are recorded.
- iPhone sign-in uses the web sign-in and receives its own token. Clients and bookkeepers are refused.
- A demo sign-in exists on staging installs only; it is off in production.

## Related

- [Account](/docs/manual/settings/account.md)
- [Roles and permissions](/docs/manual/settings/roles-and-permissions.md)