Sign-in methods
Three ways to sign into sweetdocs: email + password, Google OAuth, magic link. CAPTCHA on signup. SAML SSO coming with the Teams enterprise rollout.
Sweetdocs uses Supabase Auth under the hood. Three sign-in methods are available today; SAML SSO ships with the Teams enterprise rollout (see SSO + SCIM).
The three methods
1. Email + password
The default for new accounts. Sign up with an email and a password (minimum 8 characters in v1); sign in subsequently with the same combination.
| Aspect | Detail |
|---|---|
| Password minimum length | 8 characters |
| Storage | Hashed by Supabase Auth (bcrypt-equivalent) |
| Email verification | Required — you’ll get a verification email on sign-up |
| Sign-up CAPTCHA | Required for new accounts (Cloudflare Turnstile in v1) |
After signup, the verification email contains a link that activates the account. Until you verify, you can’t sign in fully.
2. Google OAuth
“Continue with Google” → Google’s standard OAuth consent screen → redirected back to sweetdocs.
| Aspect | Detail |
|---|---|
| Provider | Google (via Supabase Auth’s OAuth integration) |
| Scope requested | Basic profile + email |
| Account creation | First Google sign-in for a new email creates a fresh account |
| Existing email match | If you already have an email+password account at that address, Google sign-in links to the same account on first use |
This is the simplest path for Google Workspace orgs — your team can sign in with their corporate Google identity.
3. Magic link
A passwordless alternative: type your email, get a single-use sign-in link, click it from the email.
| Aspect | Detail |
|---|---|
| How to access | Forgot Password page → enter email → “Send me a link” (also serves as a passwordless sign-in path) |
| Link validity | A short window (typically ~15 minutes) before the link expires |
| Single-use | Once clicked, the link can’t be reused |
| For existing accounts | Signs you in directly |
| For new emails | Creates a new account on first click |
Magic links are useful when you don’t remember your password and don’t want to reset it, or when typing a password on a mobile device is inconvenient.
Linking multiple methods
A single account can be reached via multiple methods. For example: signing up with email + password, then signing in once via Google with the same email, links the Google identity to your existing account. After that, either method gets you into the same account.
There’s no manual “link my Google” UI in v1 — the linking happens automatically on first matching sign-in.
CAPTCHA on signup
New accounts require passing a Cloudflare Turnstile CAPTCHA. This is a transparent challenge in most cases (no visible puzzle); occasionally you’ll see a click-to-verify checkbox.
The CAPTCHA only applies to new account creation. Sign-in (for existing accounts) doesn’t trigger one.
Auth rate limiting
To prevent brute-force attacks, the sign-in endpoint enforces rate limits:
- Repeated failed sign-ins from the same IP slow down progressively
- A series of failures triggers a temporary cooldown
- Magic link send requests are also rate-limited
If you’re seeing rate-limit messages and shouldn’t be, contact support — there may be an upstream NAT putting you behind a shared IP.
What about SSO?
SAML SSO + SCIM ship with the Teams enterprise rollout. See SSO + SCIM for status and timeline. Until then, Google OAuth is the closest single-provider login for Google Workspace orgs; other enterprise IdPs need to wait for SAML.
Signing out
| Action | Effect |
|---|---|
| Profile menu → Sign out | Signs you out on the current device/browser only |
| Settings → Security → Sign out everywhere | Revokes all sessions across every device — see Sessions + devices |
Signing out doesn’t delete the account — it just ends the auth session.
Changing your email
Settings → Security → Email → enter a new email. Sweetdocs sends a confirmation email to both your current and new address. Click both confirmation links to finalize. The email change takes effect after both confirmations.
This double-confirmation is a defense against attackers who compromise your account and try to swap the email out.
Account deletion
Settings → Security → Delete account. Type the exact phrase DELETE my account to confirm.
Account deletion is a 30-day soft delete:
- Your account is marked
deleted_atimmediately - You can no longer sign in (or accessing any docs you owned)
- After 30 days, the deletion is finalized — data is purged
- Signing back in within the 30-day window reactivates the account
This is intentional — accidental deletion or attacker-initiated deletion can be reversed if caught quickly.