Accounts & authentication

Accounts and sign-in are handled by the LeanSignal control center (cc.leansignal.io) — the tenant apps themselves never see a password, only a session established through the control center.

Create an account

Sign up at cc.leansignal.io/onboard with an email address and a password (minimum 12 characters — the form checks strength and warns about passwords found in known breaches), and accept the Terms of Use. Alternatively, sign up directly with Google or GitHub.

Password registrations must be confirmed: you’ll receive a Confirm account email whose link is valid for 24 hours. Following it activates the account and signs you in — you cannot sign in before confirming.

Confirmation link expired?

Signing in with Google or GitHub using the same email address activates the account immediately — OAuth-verified addresses don’t need the email confirmation step.

After activation, a first-time user goes straight to tenant setup.

Sign-in methods

The control center supports three methods, and they can coexist on one account:

• Email + password
• Google
• GitHub

Methods are linked by email address: signing in with Google using the same address as your password account attaches the Google identity to it — one account, several ways in.

Sessions are cookie-based and expire after 6 hours of inactivity; use Sign out to end one explicitly.

Signing in to a tenant

Each tenant decides which of the methods its users may use — chosen at tenant creation. When a tenant app needs you to sign in, it sends you to the control center’s signing in to <tenant> page, which offers exactly that tenant’s enabled methods. After authentication you’re returned to the tenant app with a short-lived exchange code — and if you already have an active control-center session and belong to the tenant, you pass straight through without seeing a form.

Visiting a tenant you don’t belong to (or that doesn’t exist) shows a not-found page — membership is checked before any sign-in completes.

Bring your own SSO (OIDC)

A tenant can authenticate its users against your own identity provider — anything that speaks OpenID Connect (Okta, Azure AD / Entra ID, Keycloak, …). During tenant setup, choose the SSO option and provide:

• the provider’s OIDC discovery URL,
• a client ID and client secret for the app you register there,
• and register the shown redirect URI with your provider.

A built-in Test connection check probes discovery, keys, and credentials live, so you know the configuration works before anyone tries to sign in.

Password reset

Use Forgot password? on any sign-in page. If the address is registered, a reset link arrives by email, valid for 1 hour; the response is the same either way, so addresses can’t be probed. New passwords follow the same 12-character minimum.

Account states

State	Meaning
Pending	Registered but email not yet confirmed — sign-in is blocked until confirmation.
Invitation pending	Invited to a tenant but the invitation hasn’t been accepted — use the invitation email’s link.
Active	Normal state.
Disabled	Sign-in blocked by an administrator.

There is currently no self-service account page for changing your email or display name; email preferences (alert emails, all emails) are managed inside the tenant app under Preferences — see Manage users.

Next steps

• Tenants & workspaces — what happens right after registration.
• Manage users — inviting people into a tenant.
• Security & data residency — sessions, isolation, and data handling.