The CodeCharter portal uses cookie-based login with email and password, plus a second factor if you want one.
Authentication methods
Sign-in uses email and password. As a second factor you can optionally set up an authenticator app (TOTP), which comes with recovery codes for the case where you cannot reach the app. You manage your second factors, recovery codes, and active sessions under Account and security.
On top of that, a lockout after repeated failed attempts (see below) and the sign-in log protect your account: every sign-in attempt is recorded with timestamp, IP address, and browser identifier (see Privacy and GDPR).
Signing a machine in from the CLI
Your browser session is also what authorizes a developer machine. Running
codecharter login on a workstation shows a short code and opens a page in your
browser where you confirm it. The machine then holds a token that can renew a
license for your account and do nothing else, so you no longer need an API key on
a laptop. See Browser sign-in.
Confirming requires an active portal session, which is why the page sends you through the normal login described below if you are not signed in. Every machine you approved this way is listed under Authorized devices, where you can also revoke it.
Login
On /auth/idp/login:
- Email, as entered during registration
- Password, as entered during registration
Click Sign in. After a successful login you land on the dashboard. If you were redirected to the login page from a protected page, you return to that page instead.
If you have a second factor set up, you land on a separate code-entry step after your password is accepted, see below.
Second factor
If you have enrolled an authenticator app, signing in takes one more step: enter the current code from the app, or use one of your recovery codes if you cannot reach it. A wrong code lets you try again without starting the login over.
Error messages
A wrong email, a wrong password, and an account temporarily locked after repeated failed attempts all show the same message: "Email or password did not match. Try again." If you are sure the password is right and the message keeps appearing, wait a few minutes and try again rather than retrying immediately.
Logout
Click "Sign out" in the sidebar (at the bottom next to your avatar). This ends your session and sends you back to the home page.
Session duration
After login the session lasts 14 days with sliding expiration — as long as you visit the portal regularly, the session does not expire. If you do not log in for two weeks, you need to sign in again. Every login is persistent for the full 14 days, so a separate "remember me" option is unnecessary.
Multiple browsers / devices
You can be signed in on as many devices as you like simultaneously. Each has its own session.
Security
Passwords are stored as a one-way hash — neither we nor anyone with database access can recover the plaintext.
Forgot your password?
There is a "Forgot password?" link on the login page, next to Create an account. See Password reset.
Ending other sessions
If you signed in on someone else's machine and forgot to log out, open Account and security and end that session directly from the Active sessions list. Alternatively, changing your password on the profile page signs out every other session automatically, which can take up to about 30 minutes to take effect everywhere.