# Sign-in without email

Without mail, people sign in with their email address and a password.

With mail, GoRunner emails a link and a code each time, and stores no password. Without it, it sends no email at all. **Platform › Health** says which, under **Mail**.

## What changes without mail

- **Nobody checks an address**: A mistyped address works as a user name until mail is added.
- **Invitations are links you send**: The invite sheet shows each link. The person picks a password when they open it.
- **A forgotten password needs an admin**: There is no reset email. An admin makes a reset link.
- **No warning emails**: Not even before the license ends. The License card and Platform’s notice say it instead.

## Passwords

At least 10 characters, at most 256 bytes, not the email address, and not one character repeated. GoRunner keeps only a hash.

To change yours: **Settings › Account**, under **Sign-in and two-factor**, press **Change password…**. Your other sessions end.

**What if someone types a wrong password too often?**

After 5 wrong passwords for one address from one network, that address waits 15 minutes there: “Too many wrong passwords. This address can try again at 14:47 UTC.” The time is the server’s (`TZ` in `.env`).

Other networks aren’t held up unless the address reaches 50 in all. One network may try 60 passwords in 15 minutes. A reset link, or **Clear the lockout** on the person in **Platform › People**, lifts it. The right password clears its own network’s count.

An address with no account gets the same answers, at the same speed.

## Someone forgot their password

1. An owner or admin of their organization opens **Settings › Organization › People**.
2. In the person’s row menu, choose **Copy reset link**.
3. Send them the link yourself, in a way you trust.

It works once, for 24 hours, and a newer link replaces it. Opening it shows **Set a new password**. Their other sessions end, and two-factor stays on. A spent link says “It was used, replaced by a newer one, or is more than a day old. Ask an admin for a new link.”

> **Warning** A reset link signs whoever opens it in as that person. Send it to them alone. Every link made is in the audit log.

**Who may make a reset link?**

An owner or admin of **every** organization the person belongs to, at their rank or above: only an owner makes one for another owner. A link for the person an organization belongs to, or for a platform admin, takes a platform admin who signed in with two-factor.

A platform admin makes it in the same place, **Settings › Organization › People**, of an organization they belong to. **Platform › People** has no such key. Nobody makes one for themselves, and none is made during a visit.

An unused link stops working when the person’s memberships, roles or status change, or when its maker loses the right.

## An admin forgot their own password

Run this in the install folder. It prints a link for that address, valid for 24 hours. It needs only the database, so it works while sign-in is broken.

**Docker**

```bash
docker compose exec api gorunner reset-password you@example.com
```

**Kubernetes**

```bash
kubectl --namespace gorunner exec deploy/gorunner-api -- \
  gorunner reset-password you@example.com
```

Whoever can run it can take over any account, which is why it needs a shell on the server.

## Adding mail later

Run `./setup.sh` again and choose Resend or an SMTP server. From then on, sign-in is by emailed link.

- **Passwords keep working**: The sign-in page offers **Use your password**, until each person’s first sign-in by link: “Your password works until you first sign in with an email link.” That proves their address, then the password is removed.
- **A mistyped address**: Never gets the link, so that person keeps their password.
- **Reset links stop**: With mail there is no password to reset, and **Change password…** goes away.

Remove mail again, and people who no longer have a password need a reset link. **Platform › People** marks them **No password yet**.

## Related

- [First sign-in](https://docs.gorunner.io/self-host/first-sign-in): The admin account and two-factor · 5 min
- [Invite people and set roles](https://docs.gorunner.io/build/invite-people): Members and their workspaces · 4 min
- [Organizations and people](https://docs.gorunner.io/self-host/organizations-and-people): Lockouts, two-factor resets and sessions · 5 min

Source: https://docs.gorunner.io/self-host/sign-in-without-email