Guides

Signing in

You can sign in with GitHub, GitLab, or a passkey. A passkey needs no password and no code, and no administrator has to approve a third-party app first: your device or password manager unlocks it with a fingerprint, a face, or a PIN.

Sign in with a passkey

Choose Sign in with a passkey on the console sign-in page. Your browser offers the passkeys it holds for pharen.ai; pick one and unlock it. You type no address and no password. If you belong to more than one organization, you then pick which one to open.

Create a passkey

There are two ways in, and both begin with a mailbox you control:

  • On the application page, choose Continue with email.
  • On an invitation page, choose Continue with email. An invitation sent to an address sends the link only to that address, so a forwarded invitation cannot be accepted through another mailbox. An invitation link that names no address asks you for one. For an open invitation, an owner of the organization then approves that address before you can act in it. An owner link needs no approval: the address you enter becomes the organization's owner.

You receive one link that works once and expires in 30 minutes. It opens a page with a button, and pressing the button creates the passkey in that browser. A link from Continue with email completes only in the same browser where you filled in the application page; opened in any other browser, even on the same device (a mail app's built-in browser, for example), it offers a fresh link to open in the right one instead. An invitation link completes on whichever device opens it. Creating a passkey does not replace the review of a new organization: platform access still follows application approval.

You hold one passkey identity and can belong to many organizations. Accept another organization's invitation while signed in and it appears in the same switcher, with its own address on that membership. Add a second passkey, on another device or a hardware key, so losing one device is not losing access.

The address check, every 30 days

For each organization you belong to with a passkey, Pharen asks you to confirm the address on that membership once every 30 days. An organization may set a shorter interval, as little as 7 days. The check is a link to that address and a passkey prompt on the same page; a link pressed by someone else confirms nothing.

You have 7 days of grace after it is due. After that, that organization is refused until you confirm, and the refusal offers a new link, so it is never a dead end. Your other organizations are unaffected. The check is how an organization learns that a mailbox it controls has closed: when an employer closes the mailbox, that membership lapses. Signing in with a passkey never depends on mail.

Changing the address a membership is checked against needs another owner of the organization to approve it. A sole owner's change completes after a 7-day hold, and the organization's contacts are told and can refuse it.

Add or remove a passkey

Your passkey page in the console lists your passkeys. Each add or remove asks for its own passkey prompt, made for that action; an earlier sign-in or prompt never counts. A CLI session or a bare console cookie is refused.

If you lose every passkey

An owner of each organization you belong to can reset your membership. The reset sends a link to the membership's address; you create a new passkey from it, and your new device shows a short phrase. The reset completes only when the owner types that phrase, so tell it to them in person or on a call to a number they already had, never in a chat or in anything the same mailbox or work account can sign in to. Until then the membership stays signed out, and a mailbox alone gains nothing. A reset in one organization does not touch your access to another. If you were the only owner, write to [email protected] for individual review; keeping a second owner or a second passkey is what prevents this.

Sign in from the CLI

bash
pharen auth login --passkey

The command opens your browser, you unlock a passkey and pick one organization, and the result returns to the command through a loopback address on your own machine. The session is bound to that organization and lasts 90 days. Only continue in the browser if you just ran the command yourself.

What is not offered

  • No email-only sign-in. A mailbox lets you create a passkey and confirm an address. It never signs you in on its own.
  • No headless passkey sign-in to the CLI (above).
  • No passwords, SMS codes or one-time codes.