Sign-in & OAuth

To create a Geiger account, open the sign-up page and type your email under Email. A password field appears below it: type a password of at least 8 characters, then choose Create account.

Dash shows Check your email and sends a confirmation link to that address. Open the link to activate your account. Dash signs you in and starts setting up your first organization, which the Quickstart walks through.

You can also create an account from the sign-in page with Continue with Google or Continue with GitHub. If your organization uses SSO, you don't need to sign up first: signing in with SSO creates your account.

To sign in, open the sign-in page and pick one of its options:

• Email and password: type your email under Email, then your password in the field that appears, and choose Continue.
• Continue with Google or Continue with GitHub: sign in with that account. If it's new to Geiger, Dash creates your Geiger account.
• Sign in with a passkey: use your fingerprint, face or device screen lock. Set up a passkey first, as Passkeys describes.
• Continue with SSO: sign in through your organization's identity provider, as Signing in with SSO describes.

If a sign-in fails, the page shows why above the Email field. After an email-and-password sign-in, Dash can offer to set up a passkey before it moves on.

Where you land depends on how you arrived. If Dash sent you to sign in from Organizations or from an app, you go back there once you're in, to the top of it rather than the exact page you opened. Otherwise, an email-and-password or passkey sign-in opens the Geiger home page, and Google or GitHub opens Organizations. Whenever an account that doesn't belong to an organization yet opens Organizations or an app, Dash sends it to set one up first.

A passkey lets you sign in with your fingerprint, face or device screen lock instead of a password. To use one, choose Sign in with a passkey on the sign-in page and confirm in your browser's prompt. Closing the prompt cancels the sign-in without an error.

After you sign in with your email and password, Dash shows Sign in faster with a passkey if your browser supports passkeys, your account has none yet, and you haven't turned the offer off on this browser:

• Set up passkey creates a passkey through your browser's prompt, then takes you on to where you were going. If setup fails, Dash says why and the dialog stays open.
• Not now skips it. Dash asks again at your next email-and-password sign-in.
• Don't ask again turns the offer off for your account on this browser.

To manage passkeys, choose your avatar at the top right of Dash, then Profile, and open the Security tab. Under Passkeys, Add Passkey creates one through your browser's prompt. Each passkey is listed by name, with when it was added and when it was last used. The trash icon beside a passkey removes it straight away, without asking.

Adding a passkey on a device that already has one for your account fails with This device already has a passkey for your account. If the card says This browser doesn't support passkeys., switch to a browser that does to add or use one.

To change the email you sign in with, choose your avatar at the top right of Dash, then Profile, and open the Security tab. Under Email Address, type the new address and choose Change Email. Dash sends a confirmation link to the new address, and the change takes effect once you open it. Until then, your current email stays in place, with a Verified or Unverified badge beside it.

To set a new password, go to Password on the same tab. Type it in New Password and again in Confirm Password, then choose Update Password. It needs at least 8 characters: Update Password stays disabled until it has them. If the two don't match, Dash shows The two passwords do not match. and changes nothing. Dash doesn't ask for your current password, and you stay signed in.

Your name, picture and the rest of your profile are covered in Profile.

To sign out, choose your avatar at the top right of Dash, then Sign out. Dash signs you out straight away, without asking, and opens the Geiger home page.

To end every session on every device at once, including the one you're using, choose your avatar, then Profile, open the Security tab and choose Sign Out Everywhere under Sessions. Dash doesn't ask first. It shows Signed out on every device. and opens the sign-in page. Use it after signing in on a computer you don't own, or if you think someone else has access to your account.

Organization SSO lets your members sign in to Geiger through your organization's own identity provider, using OpenID Connect or OAuth 2.0. It needs the OAuth / SSO Login add-on on the organization's plan (see Buying a plan), and each organization connects one provider.

Only the organization's owner can set it up, on the OAuth tab of Organization Settings. That tab appears only while the organization's plan includes the add-on.

The provider covers a list of email domains, like acme.com. While SSO is turned on, anyone who chooses Continue with SSO and types an email at one of those domains goes to the provider. Once the provider signs them in, Dash signs them in to the Geiger account with that email, creating the account if there isn't one, and adds them to the organization with the User role (see Roles). Members who already belong keep their role.

Everyone your provider signs in joins the organization, so control who has access at the provider. Removing a member in Dash doesn't stop them: their next SSO sign-in adds them back.

To sign in through your organization's identity provider:

1. On the sign-in page, choose Continue with SSO.
2. Type your work email under Email and choose Sign in.
3. Sign in at your organization's provider.

Dash finds your organization from your email's domain, so you don't need its ID. Once your provider signs you in, you land on your organization's project list, or back in the app you were opening if Dash sent you to sign in from one. The first time, Dash creates your Geiger account if you don't have one and adds you to the organization. Back to sign in returns to the other sign-in options.

Your organization's owner can also share its SSO login link. Opening it goes straight to your provider without asking for your email, whatever your email's domain is.

To connect your organization to an identity provider, you need to be its owner, and its plan needs the OAuth / SSO Login add-on.

1. On the Organizations page, open the organization card's ⋯ menu, choose Settings, then the OAuth tab.
2. Copy the Redirect URI with the button beside it, and register it at your provider as an allowed redirect URL. Note the client ID and, if your provider issues one, the client secret.
3. Fill in Provider name, Email domains, Client ID and Client secret.
4. Type your provider's address in Discovery / issuer URL and choose Fetch to fill in the endpoint URLs, or type the Authorization URL and Token URL yourself.
5. Choose Save provider.
6. Turn on the switch beside the provider's name. Its badge changes from Disabled to Enabled, and members can sign in with SSO.

A new provider is saved turned off, so nobody can use it until you turn it on. Save provider needs a provider name, a client ID, at least one email domain, and an authorization URL and token URL, typed or read from a discovery URL that works. When one is missing, Dash names it, as in Add at least one email domain (e.g. acme.com).

Dash builds the Redirect URI from the address you have Dash open at, so open Dash at the address your members sign in at before you copy it.

Once a provider is saved, the OAuth tab in Organization Settings shows its name and protocol with an Enabled or Disabled badge, its email domains, the Redirect URI, the SSO login link and the Client ID.

• The switch beside the provider's name turns SSO on or off for the whole organization as soon as you change it. While it's off, nobody can sign in through the provider, by email or by link.
• SSO login link: copy it with the button beside it and share it with members. It starts an SSO sign-in for this organization without the email step.
• Edit provider opens the setup form with your saved values. Choose Save provider to keep your changes, or Cancel. Editing doesn't turn SSO on or off.
• Remove deletes the provider straight away, without asking, and members can no longer sign in through it. To pause SSO, turn it off instead.

Turning SSO off or removing the provider doesn't remove anyone from the organization. Members who have another way to sign in, such as a password or a passkey, can still use it.

The setup form on the OAuth tab of Organization Settings has these fields:

• Provider name: the name the tab shows, like Acme SSO. Required.
• Protocol: OpenID Connect, the default, or OAuth 2.0.
• Email domains: the domains whose members go to this provider, separated by commas or spaces, like acme.com, acme.io. Dash ignores a leading @ and letter case. At least one is required.
• Discovery / issuer URL: optional. Takes your provider's issuer address or its full .well-known/openid-configuration address. Fetch reads it and fills in the authorization, token and userinfo URLs.
• Authorization URL and Token URL: your provider's sign-in and token endpoints. Both are required.
• Userinfo URL: optional. Dash reads the member's email, name and picture from it, and otherwise from the ID token, so a provider that doesn't return an ID token needs it.
• Client ID and Client secret: the credentials from your provider. The client ID is required. Dash never shows the secret again once it's saved: when you edit the provider, leave Client secret blank to keep the saved one.
• Scopes: what Dash asks your provider for, separated by spaces. It starts as openid email profile, which Dash also uses if you clear it.
• Email claim, Name claim and Avatar claim: the fields in your provider's profile that hold the member's email, name and picture. Leave them blank to use email, name and picture.
• Use PKCE: on by default, and recommended for OpenID Connect providers.

When you choose Continue with SSO and the sign-in page shows No SSO provider is set up for that email domain., Dash found no provider that's turned on for the part of your email after the @. Your organization hasn't set up SSO, has turned it off, or hasn't listed your email's domain.

1. Check that you typed your work email, at your organization's domain.
2. Ask your organization's owner whether SSO is on and covers your domain, or for the organization's SSO login link, which doesn't depend on your domain.
3. If you're the owner, open the OAuth tab of Organization Settings, add the domain with Edit provider, and turn on the switch beside the provider's name.

The sign-in page shows SSO isn't available for that organization right now. when you open an organization's SSO login link while its SSO is turned off or its provider has been removed. It also appears when SSO is turned off while you're partway through signing in.

Ask your organization's owner to turn SSO back on, on the OAuth tab of Organization Settings. Meanwhile, sign in another way if your account has one, such as a password or a passkey.

The sign-in page shows SSO sign-in failed. Please try again. when Dash can't finish a sign-in with your organization's provider. Dash allows 10 minutes between choosing Sign in and coming back from the provider, in the same browser, so a sign-in left open longer or finished in another browser fails. It also fails when the provider turns down Dash's request, for example because the client secret is wrong.

1. Start again from the sign-in page, and finish at your provider within 10 minutes in the same browser.
2. If it keeps failing, ask your organization's owner to check the Client ID, Client secret and Token URL on the OAuth tab, and that the Redirect URI is registered at the provider.

Your provider didn't return an email address. means the provider signed you in but Dash found no email in your profile. The owner can fix it by adding email to Scopes, setting Email claim to the field the provider uses, or adding a Userinfo URL.

The sign-in page shows That sign-in link was invalid or expired. when Dash can't sign you in at the end of a link. That happens with an email confirmation link that was already used, has expired or was opened in a different browser from the one you signed up in, and when the last step of a Google, GitHub or SSO sign-in fails.

1. If you were confirming a new account, sign in on the sign-in page with your email and password.
2. For Google, GitHub or SSO, start the sign-in again from the sign-in page.