GoRunner docs
Search or askSearch⌘K

Sign-in without email

Without mail, people sign in with their email address and a password.

4 min · Self-hosted

With mail, GoRunner emails a link and a code each time, and stores no password. Without it, it sends no email at all. Platform › Health says which, under Mail.

What changes without mail

Nobody checks an address
A mistyped address works as a user name until mail is added.
Invitations are links you send
The invite sheet shows each link. The person picks a password when they open it.
A forgotten password needs an admin
There is no reset email. An admin makes a reset link.
No warning emails
Not even before the license ends. The License card and Platform’s notice say it instead.

Passwords

At least 10 characters, at most 256 bytes, not the email address, and not one character repeated. GoRunner keeps only a hash.

To change yours: Settings › Account, under Sign-in and two-factor, press Change password…. Your other sessions end.

What if someone types a wrong password too often?

After 5 wrong passwords for one address from one network, that address waits 15 minutes there: “Too many wrong passwords. This address can try again at 14:47 UTC.” The time is the server’s (TZ in .env).

Other networks aren’t held up unless the address reaches 50 in all. One network may try 60 passwords in 15 minutes. A reset link, or Clear the lockout on the person in Platform › People, lifts it. The right password clears its own network’s count.

An address with no account gets the same answers, at the same speed.

Someone forgot their password

  1. An owner or admin of their organization opens Settings › Organization › People.
  2. In the person’s row menu, choose Copy reset link.
  3. Send them the link yourself, in a way you trust.

It works once, for 24 hours, and a newer link replaces it. Opening it shows Set a new password. Their other sessions end, and two-factor stays on. A spent link says “It was used, replaced by a newer one, or is more than a day old. Ask an admin for a new link.”

Warning A reset link signs whoever opens it in as that person. Send it to them alone. Every link made is in the audit log.

Who may make a reset link?

An owner or admin of every organization the person belongs to, at their rank or above: only an owner makes one for another owner. A link for the person an organization belongs to, or for a platform admin, takes a platform admin who signed in with two-factor.

A platform admin makes it in the same place, Settings › Organization › People, of an organization they belong to. Platform › People has no such key. Nobody makes one for themselves, and none is made during a visit.

An unused link stops working when the person’s memberships, roles or status change, or when its maker loses the right.

An admin forgot their own password

Run this in the install folder. It prints a link for that address, valid for 24 hours. It needs only the database, so it works while sign-in is broken.

docker compose exec api gorunner reset-password you@example.com

Whoever can run it can take over any account, which is why it needs a shell on the server.

Adding mail later

Run ./setup.sh again and choose Resend or an SMTP server. From then on, sign-in is by emailed link.

Passwords keep working
The sign-in page offers Use your password, until each person’s first sign-in by link: “Your password works until you first sign in with an email link.” That proves their address, then the password is removed.
A mistyped address
Never gets the link, so that person keeps their password.
Reset links stop
With mail there is no password to reset, and Change password… goes away.

Remove mail again, and people who no longer have a password need a reset link. Platform › People marks them No password yet.

Checked against 12d85b3b