# Sign-in and authorization

Sign in to identify yourself, or authorize an application to act on your behalf. An application gets its own credential; it does not receive your password.

## Sign-in methods

| Method | How it works | Limit |
| --- | --- | --- |
| Email and password | Enter the credentials for your account on the Lepsto sign-in page. | A second-factor challenge follows when required. |
| Passkey | Choose **Sign in with a passkey**, or use a saved passkey offered from the email field. Confirm with the device's fingerprint, face, or PIN prompt. | Requires an existing passkey. Self-service passkey management is not yet available in Account settings. |
| Google or GitHub | Choose **Continue with Google** or **Continue with GitHub**, then complete the provider flow. | Social sign-in is offered on the main sign-in page; the authorization consent flow uses email and password. |

A passkey sign-in does not request another factor. Adding a passkey leaves existing sign-in methods available; canceling its dialog returns you to the sign-in form.

A first social sign-in can create an account. Linking a provider to an existing email requires the provider to report that email as verified. An invitation is carried through the provider round trip; an unusable invitation shows an explicit error.

New to Lepsto? [Get started with a 30-day trial](/get-started).

## OAuth authorization

Interactive applications use OAuth 2.1 authorization code flow with PKCE. You sign in on Lepsto's page, review requested scopes, and grant or deny access. The application then exchanges the one-time code for its own credentials. PKCE is required; the implicit flow is not supported.

| Scope | Information requested |
| --- | --- |
| `openid` | Your identity; required. |
| `profile` | Display name and avatar. |
| `email` | Email address. |

These scopes request identity information. Product grants and operation permissions still determine what a platform call may do.

Approval is remembered per application. Requesting an additional scope prompts you again. Denying returns an access-denied result without issuing credentials.

## Credential lifetimes

| Credential | Lifetime and reuse |
| --- | --- |
| Authorization code | Single-use; expires after 10 minutes. Reuse revokes credentials issued from it. |
| Access credential | Expires after one hour; the application can renew it. |
| Renewal credential | Expires after 30 days without use. Each renewal replaces it; reuse of an old credential revokes the chain. |

An application can relinquish its access without signing you out of Lepsto. Your browser sessions have [separate limits](/account/sessions).

OAuth is the interactive authorization path. Headless clients can also use [API keys](/interfaces/api-and-keys), while the [CLI](/interfaces/cli) supports browser device authorization and supplied tokens.