Sign-in

Let people sign in with Google, Microsoft Entra ID or another OpenID Connect provider, and choose which ways to sign in are on.

By default people sign in with their email and a password. You can also let them sign in with an account they already have: Google, Microsoft Entra ID, or any provider that supports OpenID Connect, such as Authentik or Keycloak.

Go to Settings > Sign-in to see every way to sign in. They show on the sign-in page in the same order. Drag a row by its handle to change the order, then save.

Go straight to the provider

If the only way to sign in that's turned on is a single provider, metrd skips its own sign-in page and sends people straight to that provider. Turn off Go straight to the provider on the same page to always show the sign-in page instead. The lockout link and any sign-in error still show the page.

Add a provider

Choose Add provider and pick Google, Microsoft Entra ID or OpenID Connect.
Give it a name. People see it on the button as "Continue with Google".
Register metrd with the provider and copy the Redirect URI shown into it.
Fill in the details the provider gives you, then save.

New providers start turned off. Open the provider and check Connection check says it found the provider, then turn it on.

Google

Create an OAuth client of type Web application in Google Cloud and add the redirect URI. Copy the client ID and secret into metrd.

Microsoft Entra ID

Create an app registration in your tenant, add the redirect URI as a Web platform, and create a client secret. Copy the directory (tenant) ID, application (client) ID and secret into metrd.

Only your own tenant is supported, so the email addresses it sends are ones your organisation controls. If accounts have no email in their tokens, add the email optional claim to the app registration.

Other OpenID Connect providers

Enter the issuer URL (metrd reads /.well-known/openid-configuration from it), the client ID and the scopes. The client secret is optional for providers that allow public clients.

Connect an account

Nobody is linked to a provider automatically, even if the email matches. There are two ways in:

Signed-in users go to Your account > Sign-in methods and choose Connect.
Invited people can accept their invite with a provider instead of choosing a password. The provider's verified email has to match the invite.

People who join through a provider don't have a password. They can set one from Your account while password sign-in is on.

You can disconnect an account from the same page, as long as it isn't your only way to sign in.

Two-step verification

Anyone who signs in with a password can add a code from an authenticator app, such as 1Password, Google Authenticator or Microsoft Authenticator. Go to Your account > Sign-in methods, choose Set up, scan the QR code and enter the code it shows. Your other devices are signed out.

You then get 10 recovery codes. Each one signs you in once if you lose your phone, and they're only shown once, so keep them somewhere safe. You can make new ones at any time; the old ones stop working.

Signing in with a provider skips this step, because the provider handles its own checks.

If someone loses both their authenticator app and their recovery codes, another user can choose Remove two-step verification on them under Users.

Open Email and password and turn it off to only allow providers. metrd won't let you do this until you've connected a provider to your own account, and it always keeps at least one way to sign in turned on.

While it's off, passwords can't be changed and invites can only be accepted with a provider.

Lockout link

If a provider stops working, open /auth/sign-in?local to get the password form back. Anyone who has a password can sign in this way, and those sessions are marked as lockout sign-ins under Sessions. Two-step verification still applies.