Sign-in methods

You can sign in to Free Invoice Automation in several ways, and you can use more than one on the same login. Whichever you choose, you end up with one login identified by one email address, which can belong to your own account and to any accounts you are a member of. This page covers each method, how sessions work, and the sensitive actions that ask you to sign in again.

Methods at a glance

Enterprise single sign-on (SSO) is planned for after launch, with the Enterprise plan.

Email and password

Create your login with your email address and a password at app.freeinvoiceautomation.com/sign-up.

• Length, not complexity. We ask for a minimum length rather than forcing symbols or numbers. A long passphrase is easier to remember and harder to guess.
• Breached passwords are refused. When you choose a password, we check it against a list of passwords known from public data breaches. Only the first few characters of a hash of the password are sent for this check, never the password itself. If it is on the list, choose another.
• Forgotten password. Choose Forgot password on the sign-in page. We email a single-use reset link that expires after a short time. Passwords can only be reset by email.
• Lockout. After several wrong passwords in a row, the login is locked for a while and further tries are slowed down. This stops people guessing passwords.

Verify your email

After sign-up we send a verification link. You can use the app straight away, but you need a verified email before you can send documents through our platform email. Your own SMTP sender does not need it.

Google and Apple

Choose Continue with Google or Continue with Apple on the sign-in page. If you do not have a login yet, one is created and a Free account is set up with you as Owner.

• Linking to an existing login. A social sign-in is joined to an existing login with the same email only when the provider confirms that the email address is verified. Otherwise, sign in with your existing method first and link the provider from Settings > Security. This stops anyone taking over your login with an unverified address at a provider.
• Apple private relay. If you choose "Hide my email", Apple gives us a relay address. We accept it as your login email.
• What we receive. Your name, email address and the provider's id for you. We use them only to sign you in.

Magic link

Enter your email and choose to receive a sign-in link. The link:

• works once; a second use is refused,
• expires after a short time; if it has expired, ask for a new one,
• is stored on our side only as a hash, and is tied to your email.

Sessions

When you sign in, you get a session in the web app. Session cookies are secure, HTTP-only and protected against cross-site request forgery.

• How long you stay signed in. Sessions renew while you use the app and end after a period of inactivity, with a maximum lifetime after which you sign in again.
• Sign out everywhere. Settings > Security lets you end your sessions on every device. Changing your password also ends your other sessions.
• Which account is active. If your login belongs to several accounts, the switcher at the top of the app sets the account you are working in. Permissions, plan and branding always follow that account.

Fresh sign-in for sensitive actions

Some actions could do real harm in the wrong hands, so they ask you to sign in again if you have not done so in the last few minutes. That way a session left open on a shared computer cannot be used for them.

If your session is not fresh, the API answers fresh_signin_required (HTTP 401) and the app shows the sign-in step. After you sign in, repeat the action.

Signing in from code and AI assistants

The API, CLI and connectors do not use your password or session. They use API keys, created in Settings > API keys, which are bound to one account, carry scopes and can be revoked at any time. AI assistants connect to the MCP server with OAuth: you sign in with any of the methods above and approve the scopes on a consent screen. See Authentication and MCP authentication.

API keys cannot perform the fresh-sign-in actions above; those are done by a person in the web app.

Protection against abuse

• Sign-in, sign-up, magic-link and password-reset requests are rate limited per IP address and per email.
• Sign-up, password reset and magic-link requests give the same answer whether or not an email is registered, so nobody can use them to find out who has a login.
• Sign-in events (sign-in, sign-out, password change, two-factor change, new device) are written to your audit log with time and IP.

Errors

Related pages