# Sign-in methods

> Sign in to the console with GitHub, Google, or an emailed code, and link or remove sign-in methods.

The console uses browser sign-in. Which methods appear depends on your deployment; the usual set is **GitHub**, **Google**, and **email**. Your first sign-in creates your VMYard user.

## GitHub and Google

Choosing a provider sends you to it and back. VMYard identifies you by the provider's account, not by email address. GitHub sign-in needs a **verified primary email** on your GitHub account.

## Email codes and magic links

1. Enter your address. VMYard always answers the same way, whether or not an account exists.
2. Check your email for a **6-digit code** and a sign-in link. They are one credential: valid for 10 minutes, usable once, and replaced by any newer request. Five wrong codes use it up.
3. Type the code, or click the link. The link works only in the browser that asked for it; on another device, type the code.

You can request 5 emails per address and 20 per network address per hour, and verify 30 codes per network address per 10 minutes. Beyond that, VMYard answers `429 rate_limited` with a `Retry-After` delay.

## One person, several methods

Sign-in methods never merge on their own: a GitHub account and an email address with the same address are two different users until you link one to the other.

To link a method, sign in, open **Account**, and choose the method to add. For email, VMYard sends a code to the new address. Linking and removing need a sign-in within the last **15 minutes**; if yours is older, the console asks you to confirm it's you first.

- You can't remove your last sign-in method (`409 last_login_method`).
- A method that already belongs to another user can't be linked (`identity_in_use`).
- Removing a method doesn't end sessions that are already signed in.

## Sign-in errors

When sign-in fails, the console shows one of these codes in the address (`/sign-in?error=…`) with an explanation:

| Code | Meaning |
| --- | --- |
| `access_denied` | You declined at the provider. |
| `identity_in_use` | That identity is already linked to another user. |
| `oidc_failed` | The provider's answer couldn't be verified, or GitHub had no verified primary email. |
| `oidc_unavailable` | The provider couldn't be reached. Try again later. |
| `session_expired` | The sign-in attempt expired or was already used. Start again. |
| `unsupported_provider` | That method isn't configured on this deployment. |

## Signing out

**Sign out** in the console ends the browser session. API keys aren't affected; revoke a key to stop it working.