Authentication
Unit Oncall supports several ways to sign in. You pick a method when you create your account and can add or remove methods later. Every account is identified by a single email address, and all sign-in methods resolve to that same account — so signing in with Google and later with a passkey logs you into the same place.
Sign-in methods
| Method | How it works | Notes |
|---|---|---|
| Email and password | Classic email address plus a password. | Password must be at least 8 characters. |
| Sign in with a Google account (OAuth). | The Google account's email must be verified. | |
| GitHub | Sign in with a GitHub account (OAuth). | The GitHub account's primary email must be verified. |
| Passkey | Passwordless sign-in using a device passkey (WebAuthn / FIDO2). | Works on devices and browsers that support passkeys. |
When you sign in with Google or GitHub for the first time using an email that already has a Unit Oncall account, the provider is linked to that existing account instead of creating a duplicate.
Signing up
- Open the registration page and either enter your email and a password, or choose Continue with Google / Continue with GitHub.
- If you signed up with email and password, Unit Oncall sends a verification email.
- Open the link in that email to verify your address.
Sign-ups through Google or GitHub arrive already verified, because the provider has confirmed the email for you.
Email verification
A verified email is required for the parts of the product that send you mail or page you — for example invitations and notifications. If your email is not yet verified, the console prompts you to verify it and can resend the verification mail.
Password management
From your account settings you can:
- Change your password at any time.
- Remove your password entirely once you have at least two other primary sign-in methods — for example, two linked providers (Google and GitHub), or one linked provider plus a primary passkey. This turns your account into a passwordless one.
Two-factor methods (TOTP and email codes) and passkeys registered only as a second factor do not count as primary sign-in methods, because they cannot start a sign-in on their own. Unit Oncall requires that at least two primary sign-in methods remain after the password is removed, so you can never lock yourself out.
Two-factor authentication
After your password (or a passwordless sign-in), Unit Oncall can ask for a second factor. See Multi-factor authentication for the available factors and how to set them up. An Organization can also require every member to enable a second factor — see require_mfa in Organization settings.
Single sign-on
An Organization can require its members to sign in through a specific provider (Google or GitHub) before they can enter it. See SSO.
Sign-in flow
- Enter your credentials — a password, a passkey, or a linked provider.
- If two-factor authentication is enabled on your account, enter the second factor.
- If you belong to more than one Organization, choose which one to enter. Some Organizations enforce MFA or SSO at this step, so you may be asked to satisfy those requirements before you are let in.
Signing in and entering an Organization are two separate steps: you can authenticate successfully and still be asked to meet an Organization's MFA or SSO policy before you gain access to its data.
Related
- Multi-factor authentication — set up TOTP, email codes, or a passkey as a second factor.
- SSO — require members to sign in with a specific provider.
- Roles and permissions — what each role can do once signed in.
- Organization settings —
require_mfa,required_sso_providers, and other governance options.