Sign-in options

What it is

There are two ways into Agentency, and they both lead to the same place:

• Email and password.
• Continue with Google.

If both use the same email address, they open the same login. You do not get two dashboards by using two methods.

On top of that, three extra steps can appear depending on your account and your installation: a two-factor code, a captcha, and — on some installations — a phone check. None of them is a separate way to sign in; they are gates on the way through.

When you would use it

Read this when the sign-in form is asking for something you did not expect, or when you are deciding which method to standardise on.

Where to find it

Open /login.

Steps

1. Open /login.
2. Enter the email and password you registered with, or select Continue with Google.
3. If a field labelled Authentication code appears, your account has two-factor enabled. Enter the six-digit code from your authenticator app, or one of your backup codes. See Two-factor authentication.
4. If a captcha appears, complete it and submit again. It shows up after repeated failed attempts from your network, not at random.
5. You land on the dashboard.
6. Later, sign out from the user menu in the top bar. See Sessions and sign out.

What you will see

The sign-in page has an email field, a password field, a Continue with Google button, and a Forgot password link. That is all it has by default — the extra fields appear only when the server asks for them.

There is deliberately no "remember me" checkbox. Your session already lasts up to 30 days, so a checkbox would only be a way to make it shorter, which nobody wants and nobody would tick.

The order things happen in

Understanding the sequence explains most confusing sign-in moments:

1. Credentials are checked. Wrong password stops here.
2. Rate limiting. Too many recent failures from your address and network can stop you even with the right password.
3. Two-factor, if your account has it.
4. Phone verification, if your installation requires it — this happens after you are signed in, by redirecting you to /verify-phone.

The step people misread is the second. A correct password refused with a lockout message looks like a broken password, and it is not.

Which method should I use?

Google is faster and there is one less password to manage. The catch is that a Google-only account has no Agentency password, and two-factor enrolment requires one — so you cannot add app-based two-factor to a Google-only login. Google's own two-factor protects you at the Google end instead, which is genuinely fine, but it is a different thing.

Email and password lets you enable Agentency's own two-factor, which is worth having if you own a workspace with real customer data.

Both is allowed and is often the best answer: sign up with email and password, enable two-factor, and use Google when you want a quick sign-in from a machine where you are already logged into Google. Same account, either door.

What matters is that the email address matches. sam@company.com via Google and sam@company.com with a password are one login. sam@gmail.com via Google is a different login with a different workspace, and that is where accidental second accounts come from.

Limits and plan notes

• Sign-in works the same on every plan.
• Sessions last up to 30 days, then you sign in again.
• There is no per-device session list and no "sign out everywhere" button. See Sessions and sign out.
• Repeated failed attempts lock the account for about 15 minutes. The lock applies to the account, so waiting is the only cure — a different browser will not help.
• Two-factor is app-based only. There is no SMS code at sign-in.
• Email verification, where required, arrives as a link in your inbox rather than a step on this form. See Verify your email.

Common problems

I know the password but it still fails.

Check Caps Lock and the keyboard language first. Then consider two-factor: with it enabled, the password can be perfectly correct and the form is simply waiting for the code. Then consider the lockout — after several failures, correct credentials are refused for about fifteen minutes.

Google works but email and password does not.

That login may never have had a password. Keep using Google, or use Forgot password — but note that a reset only helps if a password exists on the account.

I have two accounts now.

Two different email addresses, so two different logins with two different workspaces. Pick the one you want to keep, and invite the other address into it as a member. See The Accounts list.

A captcha keeps appearing.

Your network has produced a lot of failed attempts recently — a shared office connection is a common cause. Complete it and continue; it stops appearing once the failures age out.

I am asked for a code and I never set up two-factor.

Then somebody did, on this account. Reset your password immediately and check Settings → Security. If you cannot get in, contact support.

The site sends me to /verify-phone after sign-in.

Your installation requires a verified phone number. That is a separate flow that runs after authentication — see Phone verification.

Sign-in works but the dashboard is empty.

You are almost certainly in the wrong workspace. Open Accounts and switch. See Switch accounts.