Docs / How-to guides

Sign-in and security

You sign in to Sokie with GitHub, Google, a passkey or a link sent to your email. The Security page, in the sidebar, shows how you sign in and where, who can reach each of your servers, and anything that needs a look.

On the sign-in page, choose Continue with GitHub or Continue with Google, or type your address under Or get a link by email and choose Email me a link. New to Sokie? The same page makes your account.

An email link works once, for 10 minutes, in whichever browser you open it. An address can be sent 5 links an hour. GitHub and Google keep their own second step, if you've turned one on there. Sokie only lets in an address your provider has verified.

If you can't get in, Troubleshooting has what each message means.

Add a passkey

A passkey signs you in with your fingerprint, face or device PIN. Under Your sign-in, on the Security page or in Settings under You, choose Add a passkey and follow the step your device asks for. Add one on each device you use with Add another passkey.

Once you have a passkey, an email link alone no longer signs you in: after the link, Sokie asks for your passkey too. You can also skip the email and choose Sign in with a passkey on the sign-in page. GitHub and Google sign-ins work as before.

Remove takes a passkey away, and it stops signing you in at once. If it was your last one, an email link signs you in on its own again.

Your sign-in, on the Security page and in Settings under You, shows:

How you sign in: GitHub or Google if you've used them, and your email link, with whether it asks for a passkey.
Your passkeys, with when each was added.
Signed in on: each browser where you're signed in, and when each was last used.

Sign out everywhere else ends every sign-in but the one you're using.

Who can reach your servers

The Security page also puts these side by side for the workspace:

Needs a look lists what to check: a server that's public, so anyone with its address can call its tools, or one where any agent can still do anything without asking. Each has one fix, like Make it private, and a way to say it's fine, like It's meant to be public.
Asked of an admin, for owners and admins, lists what members asked for: deleting a server, opening one to more people, removing an address, or putting a held deploy on production. Ask an admin has how requests work.
Who can reach what lists every server with who can connect, its calls this month, and what agents may do there without asking. Each server's Settings tab changes it: What agents may do and Change access.

CLI sign-ins

sokie login signs the CLI in as you. It opens Sokie in your browser and asks whether to sign in the CLI on this computer; choose Allow. sokie logout ends this computer's sign-in.

A CLI sign-in lasts 30 days from when you approve it, or until it goes 7 days unused. Change both in Settings, under You, in CLI sign-ins: from 1 to 90 days, and from 1 to 30 days unused. Signed-in computers pick up a change at their next refresh. Limits and plans lists every sign-in limit.

For a script or CI, use an API key instead.

The audit trail

Audit, in the sidebar, lists every change in the workspace for a year, and who made it. Its Sign-ins filter shows when you signed in and out, and changes to your CLI sign-in limits; these are kept in the workspace made for you when you first signed in. See who changed what has the rest, including how to record the IP address and browser of each change.