Signing in, invites & password reset

How you get into Neens, start to finish. Neens accounts are provisioned, not self-serve — there is no public sign-up form. You arrive either through an invite from an admin on your team, or, for the first admin of a brand-new company, through an activation email sent when the workspace is created. After that, you sign in at /login with your email and password.

This page is the front door. For managing your account once you’re in — changing your password, turning on two-factor authentication, ending other devices’ sessions — see Account settings. For inviting people, see Members & roles.

If your company uses single sign-on, typing your work email on the sign-in page shows a Continue with SSO button that takes you to your identity provider instead of asking for a password. Admins configure it in Settings → SSO.

At a glance

Surface	Where	You need
Activate your invite	Emailed link → `/activate?token=…`	Your invitation email
Sign in	`/login`	Your email + password (+ a code if MFA is on)
Forgot password	`/forgot-password`	Your account email
Reset password	Emailed link → `/reset-password?token=…`	The reset email

Every activation and reset email depends on your deployment having an email relay configured. If one isn’t, the message — link included — is written to the server logs instead of being dropped, so an operator can still hand you the link. See the FAQ.

A new teammate never picks their own password from a sign-up form — they’re invited, and they set their password from a one-time link. Here’s both sides of that.

Admins: invite someone

Open the invite form

In Settings → Members, click Invite member and enter their email (a display name is optional).

Choose a role and organization access

Pick admin, member, or viewer, and which organizations they can reach. The full meaning of each is in Members & roles.

Send it

Neens creates the account with status invited and emails a one-time activation link (/activate?token=…, valid for 14 days). The link is also shown once in the UI as a fallback — copy it right away if your deployment has no email relay.

If the link is lost or expires, use Resend invite on the member’s row; it issues a fresh link and invalidates the old one. An account that has already activated can’t be re-invited — send them to Forgot password instead.

Invited users: activate and set your password

Open the link in your email

The email from your admin contains your activation link. Opening it takes you to /activate, which checks the token before showing the form — an expired or already-used link tells you so immediately, and the fix is to ask your admin to resend it.

Set a password

Type a password that clears the rules shown live beneath the field. The requirements are published by the server and update as you type, so you never have to guess:

At least 12 characters by default. Length is what matters — a memorable passphrase of a few words beats Password1!. (Your operator can raise this minimum; the form always shows the real number.)
Not a known-breached or predictable password — anything from public breach lists, keyboard walks like qwertyuiop, or a single word with a year on the end is refused.
Not your own name, email, or company name.

If a password is rejected, the message names the rule it hit and what to do instead.

Optionally set a display name, then finish

Add a display name if you’d like (you can change it later), and submit (POST /auth/accept-invite). You’re signed in immediately — no separate trip to /login the first time.

If you’re the first admin of a new company, activation drops you on the Getting started checklist — name your workspace, invite your team, connect an LLM, and send your first trace. See Getting started. Everyone else lands in the app scoped to the orgs they were given.

Once you have a password, sign in at /login.

Enter your email and password

Submit the sign-in form (POST /auth/login). If two-factor authentication isn’t enrolled on your account, you’re in.

If two-factor is on, enter your code

When you have TOTP two-factor authentication enrolled, Neens answers with a code challenge rather than a session — nothing is signed in yet. Enter the current 6-digit code from your authenticator app (POST /auth/mfa/challenge), or use one of your one-time recovery codes if your phone isn’t to hand. On success you land where you were heading.

Two-factor is required for operator accounts and may be required for company admins on some deployments; it’s optional for everyone else. A required account signs in on its password as usual and is then taken straight to the enrollment screen before it can reach anything else.

After several wrong passwords in a row, sign-in pauses for a short, growing wait — the page shows a countdown and re-enables itself when it’s up. Nothing is broken and no one got in; this is the brute-force guard doing its job.

You don’t have to do anything but wait. The pause is short at first and never long.
The pause follows your account, not the browser tab — reloading or trying a different browser won’t clear it.
Password reset is never blocked by this. If you can’t wait, run Forgot password — completing a reset gets you back in, because the new password clears the failure streak.

A separate “Failed sign-in attempts on your account” email may arrive after a run of failures. It’s a heads-up that someone was guessing — not a sign that anyone succeeded. If it wasn’t you, reset your password and consider turning on two-factor authentication.

Reset a forgotten password

Forgetting your password is a self-service fix — you never need an admin for it.

Request a link

On the sign-in page, follow Forgot password (/forgot-password) and enter your account email (POST /auth/forgot-password).

The confirmation you see is identical whether or not that email has an account — Neens never reveals which addresses are registered, so the form can’t be used to fish for who’s on the platform. A reset email actually goes out only when the address belongs to an active account that already has a password. (An invited teammate who never set one uses their activation link instead.)

Open the reset link

The emailed link is single-use and expires after 60 minutes by default. /reset-password validates the token before it shows the form, so a stale link tells you straight away — just request a new one.

Choose a new password

Pick a new password against the same live rules as activation, and submit (POST /auth/reset-password). This spends the link, signs out every other session on your account, and signs you in fresh.

If two-factor is on, complete the code challenge

With MFA enrolled, your new password is saved but you’re not signed in until you answer a code challenge. A reset recovers your password — it is deliberately not a way past your second factor, so access to your mailbox alone can’t get someone in.

⚠️

The security and reset emails Neens sends never contain a reset link or token themselves — they point you at the Forgot password page, where you request a fresh one. So reading someone’s mailbox doesn’t hand over a working link on its own.

Troubleshooting

Symptom	Likely cause	Fix
Activation link says it’s expired or invalid	The 14-day window lapsed, or the link was already used	Ask your admin for Resend invite
”Too many attempts” on sign-in	Repeated wrong passwords paused your account	Wait out the countdown, or run Forgot password — reset is never blocked
The reset or activation email never arrived	No email relay on your deployment, or a typo’d address	Ask your operator (they can read the link from the server logs); confirm the address. See the FAQ
Sign-in accepts the password then asks for a code	Two-factor authentication is enrolled	Enter your authenticator’s 6-digit code, or a recovery code
Lost your authenticator and recovery codes	Nothing can be recovered on your own	An operator can reset your second factor — see Account settings

Account settings — change your password, manage two-factor authentication and recovery codes, and end other devices’ sessions.
Members & roles — inviting teammates, roles, and org access.
Getting started — the first-admin path from activation to your first trace.

LLM connections Single sign-on (SSO)