Administration Set up your organization
Sign-in methods
Email and password, company single sign-on, directory login or Google, plus invitations, resets and personal access keys.
For Org Admins
Choose how your people prove who they are under Admin › Organization.
The methods
| Method | How it works | Best for |
|---|---|---|
| Email (or username) and password | The default. Passwords are stored securely hashed. | Small teams, or when you have no company directory. |
| Company directory (LDAP) | People sign in with their directory password. Their name, email and group memberships are read from the directory. | Organizations with an on-premises directory. |
| Single sign-on (OIDC) | People are sent to your identity provider and come back signed in. | Most companies with a modern identity system. |
| “Continue with Google” with a verified email. | Teams on Google Workspace (in shared installations). |
Directory and SSO users are created automatically on first sign-in. The technical connection details (addresses, keys) are configured by whoever installs Space, and the admin screen shows which methods are active.
Organizations in a shared installation
In a shared (multi-organization) installation, each organization can allow email and password, Google, or both. People sign in with their email, which is unique across organizations. New organizations can sign up themselves, and may need to verify their email (a link valid for 24 hours) before they're active. Sign-up never reveals whether an email already has an account.
Inviting people
An Org Admin invites by email. The invitation link lasts 7 days and works once. Google sign-in also accepts a pending invitation for that address.
Password reset
Forgot password emails a one-hour, single-use link. For directory or SSO users, resetting happens in the company system.
Sessions
Sign-ins use short-lived access (15 minutes), renewed quietly in the background for up to 7 days. Signing out ends the session at once. A suspended organization's sessions are refused.
Personal access keys
For scripts, apps and outside AI assistants (see MCP), people can create access keys in Settings › Access keys.
- A key acts as its owner, with the owner's permissions, and can be limited to areas (chat, agents, tables, workflows and so on).
- It has an expiry (7, 30, 60, 90 days, a year, a date, or never) that can't be extended. Create a new key instead.
- It's shown once when created.
- It can't create other keys or change sign-in details, so a leaked key can't take over an account.
- Create, change and revoke events are in the audit log, and last use (time and address) is recorded.
What's audited
Sign-ins, failed sign-ins (with the attempted username) and sign-outs are recorded with the client address. See Logs and audit.