Authentication & Sign-in
How users sign in to Celiq with email/password or Google, reset a forgotten password, complete a profile, and how Luminaries manage workspace API keys.
When to use it — Any time you need to get into your workspace, recover a lost password, finish setting up a new account, or mint a key for the REST API.
Where to find it — Sign-in lives at the
/login page; password recovery at /forgot-password; API keys at Lumen → API Keys.Who can use it — Everyone signs in (Lens, Tracer, Weaver, Luminary). Minting and revoking workspace API keys is a Luminary task.
Celiq supports two ways to sign in: email and password, or Continue with Google. If you forget your password, a self-service reset flow emails you a one-hour link. New users who arrive through Google finish a short profile step, and people you invite join through an invite link. Separately, Luminaries can issue named API keys so external tools can call the Celiq REST API.
Overview
There is one sign-in screen for everyone in your workspace. From it you can:
- Sign in with your email and password.
- Continue with Google to sign in with your Google account.
- Follow the Forgot password? link to start a reset.
- Follow Start free trial to create a brand-new workspace.
Whichever method you use, a successful sign-in issues a session token that lasts seven days, after which you sign in again.
Celiq does not offer enterprise single sign-on today. SAML, SCIM, and OIDC are listed only as a future Pro capability on the Billing page — there is no SSO setup screen to configure, so the steps below are the complete set of sign-in options that exist right now.
When to use it
| You want to… | Use |
|---|---|
| Get into your existing workspace | Email/password or Continue with Google on /login |
| Recover access after forgetting your password | Forgot password? → reset link |
| Finish setting up a new Google-created account | The complete profile step (automatic) |
| Join a workspace someone invited you to | The invite link in your invitation email |
| Let an external tool or script read your data | A workspace API key (Luminary mints it in Lumen) |
Concepts
- Email/password sign-in — The classic credential pair. Celiq verifies your password against a stored hash and, on success, starts a session.
- Google OAuth — "Continue with Google" hands sign-in to Google. If your Google account is already linked to a Celiq user, you go straight in; if it is brand new, you are routed to the complete-profile step.
- Complete profile — A one-time step a new Google user finishes by entering a company name (and optional job title). Celiq then creates a workspace for them and makes them its Luminary.
- Register via invite — When a Luminary invites you, you accept through an invite link that joins you to an existing workspace rather than creating a new one.
- Password reset token — A single-use, one-hour link emailed to you when you request a reset. The newest link always wins; older ones stop working.
- Workspace API key — A named, secret token a Luminary creates for the Celiq REST API (
/v1). The full key is shown once, at creation.
Getting started
You do not need anything installed to sign in — Celiq runs in the browser.
Open the sign-in page
Go to your Celiq URL. If you are not signed in, you land on the sign-in screen ("Sign in to your workspace").
Pick a method
Use Continue with Google, or type your email and password and select Sign in.
(Admins) Open API Keys
To manage API keys, open Lumen and choose API Keys in the left navigation. This area is for workspace administrators.
Step-by-step
Sign in with email and password
Enter your email and password
On the sign-in screen, fill in the Email and Password fields.
Select Sign in
The button reads Signing in… while it works. On success you land in your workspace.
If sign-in fails
A red message appears. "Invalid credentials" means the email or password is wrong. "Your account has been disabled. Contact your administrator." means a Luminary has disabled your account — reach out to them.
Sign in with Google
Select Continue with Google
On the sign-in screen, choose Continue with Google. You are sent to Google to choose an account and approve access to your profile and email.
Existing accounts go straight in
If your Google account is already linked to a Celiq user, Google sends you back and you are signed in automatically.
New accounts complete a profile
If this is your first time, you are taken to the complete profile step (see below) to finish setup.
Reset a forgotten password
Open the reset page
On the sign-in screen, select Forgot password? to reach /forgot-password.
Enter your email
Type your email and select Send reset link. Celiq always shows the same confirmation — "If that email exists, a reset link has been sent." — whether or not an account exists, so the page never reveals who has an account.
Open the email and click the link
If you have an account, you receive a Reset your Celiq password email. The link is valid for one hour and works once. Check your spam folder if it does not arrive within a minute.
Set a new password
The reset page validates the link, then asks for a new password. It must be at least 8 characters. After saving, you are returned to sign-in with a green "Password reset successfully. Please log in." banner.
You can request a reset at most 3 times per hour for the same email. Beyond that, Celiq quietly returns the same generic confirmation without sending another email. Every new request invalidates the previous link, so only the most recent one will work.
Complete your profile (new Google users)
When you sign in with Google for the first time, Celiq has your name, email, and avatar but not your company. The complete-profile step collects the rest and provisions your workspace.
Enter your company name
A company name is required — it becomes your new workspace's name. You can also add an optional job title.
Submit to create your workspace
Celiq creates a workspace for you, makes you its Luminary (administrator), and signs you in. A welcome email confirms the workspace is ready.
If the link expired
This step uses a short-lived token. If you see "This link has expired. Please sign in with Google again.", return to sign-in and choose Continue with Google once more.
Register via invite
If a Luminary invites you to an existing workspace, your invitation email contains an invite link. Opening it takes you to the accept-invite page, where you set up your account and join that workspace with the role the Luminary assigned — you do not create a new workspace. For managing who is invited, see Users.
Examples
A typical first sign-in for someone joining through Google looks like this:
- They open Celiq and select Continue with Google.
- Google returns them to Celiq; because they are new, they land on the complete-profile step.
- They type
Northwind Tradingas the company name and submit. - Celiq creates the Northwind Trading workspace, makes them its Luminary, and drops them into the app.
Once inside, a Luminary who wants a key for the REST API mints one, then uses it like this:
# Pass the key as a Bearer token…
curl -H "Authorization: Bearer ck_your_key_here" \
https://app.celiq.co/v1/reports
…or with the X-API-Key header
curl -H "X-API-Key: ck_your_key_here" \
https://app.celiq.co/v1/nodes
The base URL is /v1. The key is created in Lumen → API Keys; see API Keys for the full reference.
Best practices
- Prefer Google sign-in where possible — it means one fewer password to manage.
- Use a strong, unique password if you sign in with email and password. The minimum is 8 characters; longer is better.
- Treat reset links as secrets. Anyone with the link can set your password until it expires or is used.
- Name API keys clearly (for example,
Production Read Key) so you can tell at a glance what each key is for when it is time to revoke one. - Copy a new API key immediately. The full value is shown only once — save it in your secrets manager before closing the dialog.
- Revoke keys you no longer use. Fewer live keys means a smaller surface to worry about.
Tips
Look for the green "Key created — copy it now. It won't be shown again." banner after minting an API key. Use the Copy button there. If you miss it, you cannot recover the key — revoke it and create a new one.
Common mistakes
- Expecting the reset email instantly. Delivery can take a minute and may land in spam.
- Reusing an old reset link. Requesting a new reset invalidates every earlier link — always use the most recent email.
- Closing the API-key dialog before copying. The raw key is displayed exactly once; there is no "show again."
- Looking for SSO settings. SAML/SCIM/OIDC do not exist in Celiq today, so there is nothing to configure — use email/password or Google.
- Non-admins trying to revoke keys. Only Luminaries can revoke workspace API keys.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| "Invalid credentials" on sign-in | Wrong email or password | Re-check both, or use Forgot password? to reset |
| "Your account has been disabled. Contact your administrator." | A Luminary disabled the account | Ask a Luminary in Users to re-enable it |
| Google returns you to sign-in with an error | Google OAuth failed (oauth_error, google_failed, or server_error) | Try Continue with Google again; if it persists, contact your administrator |
| Reset email never arrives | Account may not exist, the per-email hourly limit (3/hour) was reached, or it is in spam | Confirm the address, check spam, and wait an hour before retrying |
| "Invalid or expired reset link. Please request a new one." | The link is older than one hour, was already used, or a newer link was requested | Start over at /forgot-password and use the newest email |
| "Password must be at least 8 characters" on reset | The new password is too short | Choose a password of 8 or more characters |
| "This link has expired. Please sign in with Google again." on complete-profile | The short-lived profile token expired | Return to sign-in and select Continue with Google |
| API key not shown after creation | The raw key is displayed only once and was dismissed | Revoke the key and create a new one |
| "Revoke" does nothing / not available | Only Luminaries can revoke keys | Ask a Luminary to revoke it in Lumen → API Keys |