Signing in for the first time, end to end

The flow, stage by stage#

1. Trigger — you open the app and choose to continue with Google. Nothing else on the sign-in screen does anything.
2. User or external event — Google shows its own consent screen. Connect never sees a password, and there is no password to see.
3. Authentication and workspace resolution — Google returns you with a single-use, short-lived state that Connect matches to the request it started; the session it creates carries one workspace, taken from your membership.
4. Ingest — the request that lands is checked in a fixed order: is there a valid session, is this address part of this workspace's surface, and which workspace is active for the rest of the request.
5. Canonical record — an identity row ties one Google address to one platform person; a membership row ties that person to a workspace. Both are control-plane records, outside every workspace's business data.
6. Reasoning — none. Sign-in is deliberately not a place where anything is decided about your business.
7. Knowledge, memory and rules — untouched. A new sign-in adds no knowledge and changes no rule; a first sign-in to a brand-new workspace simply finds all of them empty.
8. Autonomy and approval — nothing is approved and nothing is sent. Connect does not begin working because somebody signed in; the runtime mode decides that separately.
9. Action through a provider — the only provider involved is Google, and only for identity. No mailbox is connected, no number is claimed and no message moves.
10. Result — a session cookie your browser holds, with a lifetime fixed at the moment it was created.
11. Relationship, timeline and memory — nothing is written to any relationship. You are a member of a workspace, not a contact in it.
12. Audit, usage and Needs You — the sign-in is recorded, no allowance is spent, and the first screen shows whatever the workspace already has waiting.

Three things must all be true#

The third failure is the one that surprises people. Signing in successfully and then being told there is nothing to show is not a broken account — it is an account nobody has added to a workspace yet. Adding a colleague is the flow that fixes it, and it has to be run by somebody already inside the workspace.

What the session actually is#

• A cookie your browser holds, matched to a stored session row. The row can be revoked; the cookie on its own proves nothing.
• A lifetime fixed when it was created. Using Connect all day does not extend it — expiry is a clock, not an idleness timer.
• A workspace, resolved once from your membership and then used for every query in the request. It is never read from a body, a query string or a header.
• An audience: an Owner session and a customer session take different paths through the same application, which is why a screen can behave differently for the two.

Signing in as somebody else on the same browser ends the session it replaced on that browser only. Your other devices are untouched, deliberately: ending every session on every device because somebody used a shared laptop is a worse outcome than the one it prevents. Ending the others is a separate, explicit action — see Sessions.

What a first sign-in does not do#

It connects no mailbox, claims no phone number, imports no contacts and starts no work. That is worth saying because the empty screen after a first sign-in is often read as a failure when it is the correct result: Connect has nothing to show because nothing has been given to it yet.

The sequence that turns an empty workspace into a working one — profile, channels, knowledge, rules — is Setting up a workspace, and the first hour of it is walked through in Your first hour.

When it does not work#

The consent screen never returns

The return carries a single-use state with a short life. A retried or bookmarked return is refused on purpose; start again from the app rather than reloading the return.

You are signed in but every screen is empty

Membership, not authentication. Somebody inside the workspace has to add the account.

You land in a workspace you did not expect

Resolution follows membership. You are in the wrong workspace covers switching and what a session actually carries.

It worked yesterday and asks again today

The session reached its fixed lifetime, or it was revoked. Neither is a fault; You were signed out explains how to tell which.

Questions#

Related#

• Signing in with Google
• Sessions
• Which workspace you are in
• You cannot sign in
• Setting up a workspace, end to end
• Your first hour