Account & organisations
Sign-in and security
Passwords, Google and Microsoft, your organisation's single sign-on, two-factor authentication, and the alerts you cannot switch off.
Sign-in settings are under Profile → Security, which links out to the dedicated account-management screen for anything that touches credentials.
Ways to sign in
An account can sign in with an email address and password, with Google, with Microsoft, or through an organisation's single sign-on. These are not exclusive — the same verified email address is one account however you arrive, and you can use whichever is convenient.
Tip
If you created your account through Google or Microsoft you may not have a password at all. The Security tab offers to set a first one, which is worth doing before you ever need to sign in somewhere that provider is unavailable.
Single sign-on
An organisation's owner can connect its identity provider — Microsoft Entra ID, Google, Okta, or anything that speaks SAML 2.0 or OIDC — from Settings & Admin → Sign-in & Security. Once a connection is enabled, anyone with an email address on the organisation's verified domain can sign in with it, and a colleague signing in that way for the first time is added to the organisation automatically.
To use it, open the organisation's address — <org>.spacesync.app — or go to the sign-in page and enter your work email; the page recognises the domain and shows the Sign in with SSO button. Sign-in always happens on spacesync.app and brings you back to the organisation afterwards.
Require SSO
An owner can make single sign-on mandatory. When it is on, members whose email is on a verified domain can no longer use a password or Google or Microsoft to reach the organisation's projects — those sign-ins are refused and pointed at SSO. Your personal projects are unaffected, and so are guests. Organisation owners keep their password — with two-factor authentication — as a break-glass route in case the identity provider is unavailable.
Two-factor authentication
Turn it on from Profile → Security → Two-factor authentication. Scan the QR code with an authenticator app (or enter the key by hand), confirm a code, and save the backup codes it shows you — each one signs you in once if you lose the device. You can regenerate the codes or switch two-factor off from the same card.
Once enabled, password, Google and Microsoft sign-ins ask for a six-digit code — or a backup code — after the first step. Tick Trust this device for 30 days to skip it on a machine you use every day. Single sign-on sessions are not asked again: your organisation's identity provider is responsible for that step.
Some organisations require it
An owner can make two-factor authentication mandatory for the organisation. If yours has, the organisation's pages show a blocking screen until you enrol — the screen sets it up in place, and access is restored the moment you finish. A single sign-on session counts as having satisfied the requirement.
Resetting a password
Use Forgot password on the sign-in screen. A reset link goes to your registered address. If it has not arrived within five minutes, check spam before asking support — that is where it usually is.
New sign-in alerts
When your account is signed into from a device or location we have not seen before, you get a security notification. This one is not subject to your notification preferences — you cannot switch it off, because a security alert you can silence is not a security alert.
Careful
If a sign-in alert describes something you did not do, change your password immediately and then contact support. See Getting support.
Deleting your account
Account deletion is handled by our team rather than by a self-service button, because it is irreversible and frequently takes other people's work with it. Email us from your registered address and we will process it. If you own an organisation, transfer it first — see Organisations. Your rights over your data are set out in the Privacy Policy.