Accounts & invites

Each person has private canvases. There are no shared workspaces in this version.

Sign in

When Google or GitHub env is set, those buttons are the main path. Email/password is for local bootstrap, break-glass, and invited friends who skip OAuth.

Bitfield does not send email. There is no password-reset mailer.

Invite-only

Set AUTH_DISABLE_SIGNUP=true so strangers cannot create accounts (password and OAuth). Redeploy after flipping the flag so the login page matches.

Admins invite from Settings → User Management:

Enter the friend’s email.
Copy the /invite/… link (7-day expiry).
Send it in chat yourself.

Accepting verifies that email, so Google/GitHub can link if they use the same address. They may set a password on the invite page or skip it and use OAuth. Public /register stays closed.

The logged-out splash offers paste invite link when signup is locked.

Settings

Header Settings (account icon):

Account — display name, email (read-only), linked providers.
Security — change password if you have a credential login. OAuth-only users have no password fields.
User Management (admins) — last login, invites, promote-by-email, ban / unban / delete (not yourself; not the last remaining admin).

Sign out stays on the canvas header.

This instance

If you are on a hosted Bitfield someone else runs, you only need an invite (or an existing account). If you run your own, start with Self-host or Cloud deploy, bootstrap an admin, then lock signup.