Accounts, organizations and administration

Conventions used on this page

The auth service supports substantially more than the web UI currently surfaces. Rather than blur that, each capability below is labeled:

UI: You can do this in the web app today.
API-first: The platform supports it over HTTP, but there is no web page for it yet.
Operator-provisioned: The capability exists in the service, but enabling it requires backend configuration — no self-serve UI and no public API endpoint.

Account lifecycle

Sign up at /signup. Passwords must be at least 12 characters and pass a score-based strength check. The verification link expires in 24 hours and can be resent up to 3 times per hour.

Sign in at /login. The server distinguishes several failure conditions, and the UI shows a generic message for most of them by design:

Condition	What happens
Email not verified	Sign-in is refused until you verify; resend is available
Account locked	After 10 failed attempts the account locks for 15 minutes
Org enforces SSO	Password sign-in is refused (`sso_required`) — use your identity provider
MFA enrolled	The API returns `mfa_required`; see the honesty note below
No org membership	You are routed to onboarding with a short-lived (15-minute) token

Forgot password responses are deliberately neutral so they cannot be used to probe which addresses are registered. Reset links are valid for 60 minutes, and on success all active sessions are signed out. Changing your email is a two-step confirm-by-link flow that also signs out all sessions.

Authentication methods

Method	Status	How it works today
Local email + password	UI	The default. 12-character minimum plus strength scoring, Argon2 hashing, lockout after 10 failures.
OIDC / social redirect	API-first	`GET /auth/login?provider=...` starts a redirect flow and `/auth/callback` completes it. The `/login` page does not yet show an SSO button — the flow exists server-side only.
SAML SSO (per org)	Operator-provisioned	SP-initiated SSO at `/auth/saml/{orgSlug}/sso`. Identity-provider metadata is stored on the org record; there is no self-serve UI to configure it yet.
MFA — TOTP	API-first	`POST /auth/mfa/totp/setup` returns a QR URI and secret; `/verify` checks codes.
MFA — WebAuthn	API-first	Assertion begin and verify endpoints under `/auth/mfa/webauthn/*` (FIDO2).
SCIM 2.0 provisioning	API-first / operator token	List, provision, update, and deactivate users from your identity provider, authenticated with an org-scoped SCIM bearer token plus an `X-Org-Id` header.
API keys	API-first	Create with name, scopes, and optional expiry; list; revoke. The full key is shown once at creation; only a hash is stored.
Device-code flow (CLI)	API-first	`relixq login` requests a code, you approve it, and the CLI polls for the token. Codes expire after 15 minutes. There is no web approval page yet.

Organizations

Two ways into a new organization: /orgs/new is the direct form and makes you the owner; /onboarding is the funnel for signed-in users who belong to no org yet.

Slug rules are server-enforced: lowercase kebab-case, 3–40 characters, with distinct errors for taken, reserved, and invalid. A single account can belong to at most 50 organizations.

The org switcher lists every org you are a member of; picking one re-mints your session token scoped to that org. Your token always carries exactly one active org — there is no cross-org session. If you are signed in but belong to no organization, you land on /no-access.

Invitations

Invite teammates from Org Settings → Invitations: an email and a role (Member, Billing admin, or Owner). Recipients receive a 7-day link; until they accept, the invite is pending.

Only owners and billing admins can create, list, resend, or revoke invitations.
Only an owner can invite another owner.
Inviting an existing member returns already_member.
Invitations are rate-limited to 100 per org per hour.

The invite link opens a preview showing the org, role, invited email, and expiry. Signed out, you are prompted to sign in with the invited email. Signed in as a different email, you see a mismatch warning — and deliberately, the server does not reveal org details to a mismatched viewer. Invalid, expired, revoked, and already-used links each get their own message.

Members and roles

Three org-level roles exist: owner, billing admin, and member. What the server enforces:

Invitation management — owners and billing admins only.
Role changes — owners only; you cannot self-elevate.
Removing a member — owners can remove anyone; anyone can remove themselves.
Last-owner protection — the server refuses any change that would leave an org with zero owners.
Transfer ownership — owners only.

Org settings tabs

Tab	What it shows
General	Name, slug, plan badge, member count, created date, org id. Read-only.
Authentication	Read-only status pills: SSO enabled and provider, local login allowed versus forced SSO, MFA required versus optional.
Members	The members table with a live count in the rail badge.
Invitations	The invite form plus the invitation table, with a pending count.
Audit log	The last 25 authentication and membership events: when, action, actor, IP, and details, with failed events flagged.

Project administration

Project settings currently show Details — name, slug, description — read-only, plus a Danger zone delete that requires typing the project slug exactly. Renaming, changing the description, the default branch, the scan schedule, and the policy mode are available via PATCH /api/v1/projects/{id} (API-first).

Projects also have their own member list with project-level roles, managed via GET/POST/PATCH/DELETE /api/v1/projects/{projectId}/members (API-first).