Signing in, staying signed in, and signing out

Signing in

Open the sign-in page and choose Continue with GitHub or Continue with Google. There are no passwords. Your first sign-in creates your account, using the verified email address the provider shares. If you later sign in with the other provider using the same verified address, you reach the same account. If you rename your GitHub account, Deftro picks up the new name the next time you sign in with GitHub.

If the page says the address already has an account and this provider has not verified it, sign in the way you did before.

If you asked to delete your account in the last 14 days, signing in cancels the deletion. Your account comes back, but API tokens stay revoked, so make new ones if you need them.

If you see This sign-in is not available, that address or provider account cannot be used here because of an earlier staff decision. The page tells you how to appeal.

If you see a message to try again, we could not finish checking your sign-in. Wait a moment and try once more.

Each sign-in is kept in a history for one year: the provider, a keyed hash of your IP address, your browser and the result. See the privacy policy.

How long a sign-in lasts

A browser sign-in lasts 7 days. Using Deftro keeps it fresh, so you are asked to sign in again only after a stretch away.

See and end your sign-ins

Go to Settings > Security. Signed-in browsers lists each browser, when it signed in and from which address. Yours is marked "This browser".

• Sign out on a row ends that one session.
• Sign out the other browsers ends every session except this one.

A tab already open in that browser notices within a minute. CLI machines and the browser extension use tokens instead; they are listed under Settings > General as Connected devices.

Signing out

Open the account menu at the bottom of the sidebar and choose Sign out.

"Sign in or provide an API token"

Code: unauthorized

The request came with no valid sign-in. Your browser session ended or was signed out, or the token you used was revoked, expired or mistyped. Sign in again in the browser. For the CLI, run deftro login again; for scripts, create a new token in Settings > API tokens.

"This needs a signed-in browser session"

Code: session_required

Some actions only you can take, in person, in a browser. A token is refused for them even if it has every scope. They include approving or requesting changes in Review, withdrawing a version from review, yanking a version, accepting or declining a proposal, finishing a publish your agent handed to you, connecting GitHub, and sponsorship. Open the link in a browser where you are signed in and do it there.

During maintenance

You can still sign in and reach your account. The sign-in page says when some features are paused, and its sign-in buttons keep working.