How signing in works

This page is the single source of truth for signing in to the fremforge web UI — your org dashboard and the admin surface at frem.sh/<your-slug>/_admin/.

Two related things are covered elsewhere:

• Authenticating git itself (clone / push / pull) is a separate mechanism — HTTPS + Git Credential Manager. See Secure sign-in.
• The full first-hour walkthrough (signup → billing → SSO → invite) is in Your first hour. This page zooms in on just the sign-in step.

The shape of it

There is no password in any fremforge email. A brand-new admin is signed in by a one-time link; everyone else signs in through one of three entry points that all funnel to the same place. Once you understand those two facts, the rest follows.

First sign-in (new admin)

When your org is provisioned, the welcome email arrives with a single button:

• “Sign in to fremforge →” — a one-time sign-in link (single-use, expires in 48 hours). Click it and you’re signed in automatically; fremforge then prompts you to choose a password and turn on two-factor authentication, and drops you on your org’s welcome page.
• If your signup email already had a fremforge account, the button instead reads “Open <your-slug> →” and you sign in with your existing password.

The email also shows your admin username + signup email under “save this for break-glass recovery.” That’s not a credential to copy — it’s so you know your login identifiers. You set the password via the link.

If the link expires before you use it, just use the discovery login below and click Forgot password.

Signing in after that

Once your password (or SSO) is set, three URLs all reach your org. Pick whichever you’ll remember — they lead to the same place:

They’re layers of one funnel, not competing options: discovery resolves which org you’re signing into, the branded page offers how (SSO or password), and the universal login is the underlying form that actually authenticates you.

Your username is a stable short handle used in URLs (frem.sh/<username>), commit author lines, and @mentions — but you rarely need it, because your signup email also works as a login everywhere a username does.

After you wire SSO

Once an admin registers an auth source at Org admin → SSO (see OIDC SSO / SAML 2.0):

• Your org’s login pages (/<your-slug>/login, and the universal login) show a “Sign in with <name>” button. Clicking it starts the OIDC/SAML flow at your IdP, then returns you to your org.
• New members who sign in via SSO are auto-provisioned as fremforge users on first login (or pushed ahead of time via SCIM).
• The discovery login (/_app/login) routes SSO members the same way — email → your org → IdP.

SSO is the everyday path for your team. The local password never goes away, though — which is the whole point of break-glass.

Break-glass (when your IdP is down)

If your identity provider is ever unreachable or misconfigured, SSO members can’t get in through the IdP. The universal login at frem.sh/user/login (with no ?redirect_to= org suffix) accepts local password + 2FA and does not go through your org’s SSO — so an org owner who kept their local credentials can always get back in.

This is exactly why fremforge mints a local bootstrap-admin account at signup and never forces you off it: don’t delete that account after wiring SSO. Full runbook: SSO break-glass.

Where you land

• First time: your org’s welcome page (invite teammates, finish billing).
• After that: your Forgejo dashboard — frem.sh/<your-slug> for the developer surface (repos, issues, CI), and frem.sh/<your-slug>/_admin/overview for the fremforge admin (billing, SSO, members, audit). Bookmark the admin URL per org; there’s no in-product org switcher, navigation is by slug in the URL.

URLs at a glance