Signing in with Google
You sign in to Connect with a Google account and nothing else. There is no password login, no magic link and no recovery code, because a second route in is a second route to secure. Connect asks Google to confirm who you are, keeps your email address and Google's own identifier for you, and creates a session for that browser.
What actually happens#
Choose to sign in. Connect starts an authorisation request and stores a short-lived state row for it.
Result That row is single-use and expires in ten minutes, so a stale or replayed callback is refused rather than honoured.
Sign in at Google, on Google's own page.
Result Your Google password is never typed into Connect and never reaches it. If your Google account has two-step verification, that is where it applies — Connect has no second factor of its own to add.
Google returns you to Connect with a one-time code.
Result Connect exchanges the code, checks the state it stored, and reads the email address and Google's stable identifier for the account.
Connect resolves who that is and which workspace they belong to.
Result A session is created for this browser and you land on the app's home screen, inside one workspace.
What is asked for, and what is kept#
| Item | Where it comes from | What Connect does with it |
|---|---|---|
| Your email address | Google, verified | Identifies the Connect user; it is the key everything else hangs from |
| Google's identifier for the account | Bound to that user on first sign-in and compared on every later one | |
| A one-time authorisation code | Google, via the return address | Exchanged immediately and then useless; it is not stored |
| A session token | Connect | Stored as a hash, never in readable form, and set as a cookie on this browser |
| Your browser's user-agent string | Your browser | Turned into a short device description on the security screen, so you can recognise your own sessions |
There is no password to store because there is none to begin with. That is the whole argument for the design: an authentication store that does not exist cannot leak, be reused across sites, or be reset by somebody who answered a support question convincingly.
When it refuses#
- The email is not verified at Google
- Connect treats an unverified address as no proof of identity. Verify it with Google and sign in again.
- The identity does not match
- This Google account is not the one already bound to that email in Connect. Retrying cannot fix it — see how your Google account binds to a person.
- The user or workspace is not active
- The account exists and is suspended or closed. This is a state an administrator changes, not something a different browser will get past.
- The exchange failed
- Everything else: an expired state row, a cancelled consent, a network failure part-way through. This is the one that a fresh attempt usually clears.
The first time somebody signs in#
A new customer signing in for the first time gets a workspace of their own, with themselves as its administrator, on the Free Forever plan. Nothing has to be provisioned by hand, and nothing is shared with any other workspace from the moment it exists — the isolation boundary is not something switched on later.
The Owner's sign-in resolves differently: the operator's account is recognised as the platform owner and lands in the operator workspace. It is the same code path, the same session and the same checks; what differs is the membership it finds. The operator's workspace and a customer's covers what follows from that.
Questions#
Will there ever be a password option?
Nothing is documented here about future plans, and this corpus does not make promises about them. What is true today is that Google sign-in is the only route, and every page describing access is written on that basis.
Does signing in give Connect access to my Gmail?
No. Sign-in confirms who you are and nothing more. Reading or sending mail requires a separate authorisation with its own scopes, granted deliberately from the mailbox screen, and it can be granted for one mailbox without affecting any other.
What if I use two Google accounts?
Each is a separate Connect identity. Signing in with the second on the same browser ends the session the first was holding on that browser only — your other devices are untouched. See signing in as somebody else.