First sign-in

A new organization has one administrator account, created for your email address, with no password yet. Nobody can sign in with it until a password is set. You set it with the normal Forgot password flow. The reset link is emailed to that address, so only the person who owns the mailbox can claim the administrator account.

Claim the administrator account

1. Open https://app.autotestx.com and, on the sign-in page, choose Forgot password?

   

2. Enter your email address and choose Send reset link. The page confirms that a link has been sent.

3. Open the email from AutoTestX. It looks like this:

   ┌─ email: Reset your AutoTestX password ─────────────────────
   │ to    you@your-company.com
   │
   │ Hello …,
   │ …
   │ https://app.autotestx.com/#/reset?token=…
   │
   │ The link works once, within 30 minutes.
   └────────────────────────────────────────────────────────────

4. Open the link, then enter and confirm a new password (at least 10 characters). Choose Set password and sign in.

   

You are now signed in as the organization administrator.

Add other people

There are three ways for people to get an account.

Invite them into the organization (recommended). Go to Org members → Invite. Enter their email and name, choose an organization role (Member or Administrator), and optionally a project and a project role. This creates the account and gives access in one step, and emails them a link that sets their password (valid for 7 days). Without an email service, the invitation is printed in the server console instead: forward the link, or ask them to use Forgot password?.

Add a sign-in account only. Accounts → + Add member creates an account with a platform role. That role only controls who may manage sign-in accounts. It gives no access to any project. Use this when you will assign project roles separately.

They register themselves. The sign-in page has Create an account. A self-registered person is always a normal member, never an administrator. An email that already belongs to a member cannot be registered again; that person uses Forgot password instead.

Note for administrators: self-registration is currently open to anyone who can reach the server. The policy lives in selfRegistration() in packages/server/src/auth-routes.ts. Change it there to allow only invited people or one email domain before you expose the server to the internet.

New people do not see any project until someone gives them a role in one. See People, roles and permissions.

Sign-in rules

Rule	Value
Minimum password length	10 characters
Failed attempts before lock-out	5 within 15 minutes
Lock-out duration	15 minutes (or reset the password)
Session lifetime	7 days, or 12 hours without activity
Reset link validity	30 minutes, single use
Invitation link validity	7 days, single use
Changing your password	signs you out everywhere else

Next

→ Your first test in 10 minutes