Account security & sign-in

Your Tessule account is a single identity that can carry several sign-in methods — a password, linked social accounts, passkeys, and (in some organizations) single sign-on — plus optional two-factor authentication on top. This guide explains each method, how to manage them from Account Settings, and what happens at sign-in when protections like MFA are switched on.

If you only remember one thing: Tessule never lets you remove your last way in. Unlinking a social account, or any other change that would leave the account with no sign-in method at all, is refused — but recovering a lost second factor depends on backup codes, so save them when they are shown. They are shown exactly once.

Everything in this guide is self-service on your own account — no workspace permission is needed. The one policy imposed on you from outside is an organization’s require-MFA rule, covered below; organizations that use single sign-on are covered in Enterprise SSO & domains.

---

How sign-in works

Sign-in is email-first: you enter your email address, and Tessule works out which methods apply before showing the next step.

The sign-in flow. The password path may branch into a second-factor challenge or an enrolment requirement; the passkey path skips both.

After the email step (POST /auth/methods), the sign-in page shows only the options that apply to that address:

• the password field (unless the email’s domain enforces SSO),
• single sign-on buttons, when the email’s domain belongs to an organization with an SSO connection,
• social sign-in buttons for every provider the server is configured with,
• and Sign in with a passkey, available from the very first screen — a passkey needs no email typed at all.

Note

The methods check is computed purely from the email domain’s policy and the server’s configuration — never from whether an account exists. Nobody can use the sign-in page to probe which email addresses have accounts. The same is true of the password-reset request, which always responds identically.

Sign-in methods at a glance

Method	What it is	Where to manage it
Email & password	The classic credential pair.	Account Settings → Change password
Social sign-in	Continue with Google, GitHub, Microsoft or Apple.	Account Settings → Connected accounts
Passkey	Your device’s screen lock or a security key, via WebAuthn.	Account Settings → Passkeys
Single sign-on	Your company identity provider, set up by an org admin.	Enterprise SSO & domains

---

Passwords

The password policy

Tessule uses a length-first policy with no arbitrary composition rules — no “one uppercase, one symbol” checklist. A password is rejected when it is:

• shorter than 10 characters, or longer than 128,
• on the list of known-common passwords,
• or, during registration, an in-account password change, or an administrator-initiated reset, contains your own name or email address.

The emailed forgot-password flow currently applies the length and common-password checks only. Password-creation forms show a strength meter for live feedback as you type.

Changing your password

Account Settings → Change password. You must supply your current password. Two things happen on success (PUT /auth/password):

• Every other session is signed out — any other browser or device must sign in again. The device you changed it from stays signed in.
• If two-factor authentication is on, the change still succeeds and other sessions are still revoked, but you are asked for a verification code before this device gets its fresh session — you’ll be taken straight to the code screen.

Forgot your password

Use Forgot password? on the sign-in page. The flow (POST /auth/password-reset/request then POST /auth/password-reset/confirm):

1. Enter your email. The response is always the same, whether or not an account exists — if it does, a reset link is emailed.
2. The link contains a single-use token valid for 30 minutes. Follow it, choose a new password (length and common-password checks apply), and confirm.
3. All of your existing sessions are revoked, and you sign in fresh with the new password.

“Choose a new password” after an admin reset

If an administrator resets your account with a temporary one-time password, signing in with it does not open the app. Instead you land on a Set password screen and must choose your own password before a session is issued (POST /auth/set-password). The temporary credential is short-lived and works once.

---

Connected accounts (social sign-in)

Account Settings → Connected accounts lists every social provider the server offers — possible providers are Google, GitHub, Microsoft and Apple — and whether each is linked to your account (GET /auth/identities).

• Linking is automatic. There is no “link” button: the first time you sign in with a provider whose verified email matches your account’s email, that identity is connected. From then on either method signs you in to the same account.
• Unlinking (the Unlink button, DELETE /auth/identities/{provider}) removes that provider as a way in. It is refused if it would leave the account with no sign-in method at all — no password and no other linked provider. Signed up through a social provider and never set a password? You’ll keep at least one linked identity until you have another way in.

---

Two-factor authentication (MFA)

With MFA on, a password alone is not enough: after a correct password you must also prove possession of a second factor. Tessule supports:

Factor	How it works
Authenticator app (TOTP)	6-digit codes from an app on your phone or password manager.
Emailed code	A 6-digit one-time code sent to your account email on request.
Backup codes	Single-use recovery codes generated at enrolment. Always accepted as a fallback.

Turning it on

Account Settings → Two-factor authentication → Turn on. The enrolment is three steps:

1. Confirm your password. Every operation that touches MFA state re-proves the password first.
2. Scan the QR code with your authenticator app (or copy the setup key manually), and save the backup codes. The codes are displayed at this moment and never again — copy them somewhere safe.
3. Enter a code to confirm — either from the app, or (if you’d rather use emailed codes) a code sent to your inbox. Confirming proves you really hold the factor and switches MFA on.

Caution

Enabling MFA signs out all of your other sessions immediately — every other browser and device has to sign in again, this time completing the code challenge. This is deliberate: the moment the account gains a second factor, no pre-existing session without one survives.

What sign-in looks like with MFA on

After your correct password, you land on the Two-factor verification screen instead of the app. The challenge is single-use and expires after 10 minutes:

• enter the 6-digit code from your authenticator app, or
• click Email me a code instead to receive one by email, or
• switch to Use a backup code and spend one of your recovery codes (each works once).

Too many wrong codes temporarily locks the account and returns you to the sign-in page. An expired challenge also sends you back to start over — nothing is lost, just sign in again.

Passkey sign-ins never see this screen: the passkey ceremony already includes your device’s local verification, so it counts as multi-factor on its own.

Backup codes

Account Settings → Two-factor authentication → New backup codes regenerates the set (password required). Generating new codes invalidates every previous code, and the new set is shown once. Regenerate whenever you’ve used several, or suspect the old sheet is compromised.

Turning it off

Account Settings → Two-factor authentication → Turn off (password required). Your account returns to password-only protection — and you may lose access to organizations that require MFA (below).

Organization-enforced MFA

An organization can require MFA of all its members (its owners/admins manage this on the organization’s Security tab — see Enterprise SSO & domains). If you belong to such an organization and have no second factor:

• At sign-in, your password is accepted but you are stopped on a “Multi-factor authentication required” page naming the organization. Set up MFA right there (same three-step enrolment), then sign in again and complete the code challenge.
• If the policy is switched on while you’re already signed in, your existing access expires within 30 minutes, after which you’re asked to enrol.
• Two ways to satisfy the policy without an authenticator: sign in with a passkey (counts as MFA), or — if you sign in through your organization’s SSO — you’re exempt, because your identity provider is responsible for MFA there.

---

Passkeys

Account Settings → Passkeys manages passwordless sign-in credentials.

• Add passkey asks for your current account password, then starts your browser’s passkey prompt — Touch ID, Windows Hello, a phone, or a hardware security key. You can optionally give it a name like “Work laptop”. The passkey list shows when each was added and whether it is synced across devices (stored in a password manager or platform account, e.g. iCloud Keychain) or this device only (bound to one piece of hardware, typical of security keys). A device-bound passkey is lost with the device — keep another sign-in method or a second passkey.
• Remove asks for your current password, then deletes the passkey; it can no longer sign you in from anywhere.
• Signing in: click Sign in with a passkey on the sign-in page — no email or password needed; your browser offers the matching passkeys. A passkey sign-in also satisfies any organization MFA requirement.
• Dismissing the browser’s passkey prompt is harmless — cancel and use another method.

---

Sessions, signing out, and email verification

• A sign-in creates a session that lasts up to 30 days; behind the scenes the app periodically refreshes short-lived (30-minute) workspace credentials from it, which is also how switching workspaces works — you don’t sign in per workspace.
• Sign out ends the current session immediately. Sessions on other devices are unaffected — unless you change or reset your password, or enrol in MFA, each of which revokes every other session as a safety measure.
• Email verification: until your address is verified you’ll see a dismissible banner — Please verify your email address — with a Resend email button. Follow the emailed link to confirm. A verified email matters beyond the banner: automatic social-account linking and an organization’s domain-based auto-join both act only on verified addresses.

---

Troubleshooting

I lost my phone / authenticator. Sign in with your password, choose Use a backup code, and enter one of your saved codes. Then, from Account Settings, either regenerate backup codes or disable and re-enrol MFA with the new device. If you also registered a passkey, that works too. If you have no backup codes, no passkey, and no authenticator, contact your administrator.

“This organization requires single sign-on” when entering my password. Your email’s domain is enforced to SSO by its organization — the password path is closed for it. Use the SSO button shown on the sign-in page; see Enterprise SSO & domains.

The Unlink button says I can’t remove an account. That provider is your only sign-in method (no password, no other linked provider). Add another way in first.

I changed my password and got asked for a code — did it work? Yes. With MFA on, the change succeeds and other sessions are revoked; the code screen is just this device re-proving its second factor before continuing.

A workspace suddenly asks me to set up MFA. The workspace’s organization turned on its require-MFA policy. Enrol (about a minute), or sign in with a passkey.