OAuth / Single Sign-On

Sign in to Alpha Platform using your existing GitHub or Microsoft identity.

Overview

OAuth (Open Authorization) enables you to sign in using credentials from trusted identity providers. This provides:

• Single Sign-On (SSO) convenience
• Centralized identity management
• Enhanced security through provider
• No separate password to manage

Supported Providers

Using GitHub Sign-In

Step 1: Navigate to Login

1. Go to your organization's Alpha Platform URL
2. You'll see the sign-in page

Step 2: Choose GitHub

1. Click Continue with GitHub
2. You'll be redirected to GitHub's sign-in page

Step 3: Authenticate with GitHub

1. Enter your GitHub username or email
2. Enter your GitHub password (if required)
3. Complete any 2FA prompts

Step 4: Grant Permissions

On first sign-in, you'll see a consent screen asking to:

• Read your basic profile info
• Read your email addresses

Click Authorize to proceed.

Step 5: Access Alpha

• You're redirected back to Alpha Platform
• Existing users land on the dashboard; new users are taken to onboarding
• Session is established

Using Microsoft Sign-In

The Microsoft flow is identical: click Continue with Microsoft, authenticate with your Microsoft account, and consent to sharing your basic profile and email address.

Account Linking

Automatic Linking

If your GitHub or Microsoft email matches an existing Alpha account:

• The provider is linked to your account automatically on first OAuth sign-in
• You can use either method to sign in
• All data remains associated
• Your account is marked as verified (the provider has already verified your email)

New Accounts

If no Alpha account exists for your provider email:

• A new account is created automatically
• If a tenant has claimed your email domain (see below), you join that tenant instead of getting your own workspace
• Otherwise a trial workspace is provisioned for you (4-week trial)
• You're taken through onboarding after sign-in

Joining a Tenant by Email Domain

When a tenant has configured a custom domain (for example acme.com), users who sign in via OAuth with a matching email address (jane@acme.com) are connected to that tenant:

• By default, a join request is created. A tenant admin must approve it from Settings → Users before you can access the tenant.
• If the tenant has enabled Auto-add users with matching email domain (in Settings → Tenant, below the custom domain field), you are added as an active member immediately — no approval needed.

This also applies to existing Alpha users: signing in via OAuth with a matching email domain creates a join request for (or adds you to) the domain tenant, in addition to any tenants you already belong to. Memberships you already have are never changed by this, and users who were deactivated by an admin are not re-added automatically.

Security Considerations

Provider Security

Your security depends on your OAuth provider:

• Enable 2FA on your GitHub/Microsoft account
• Use strong provider passwords
• Review connected apps regularly
• Revoke access for apps you don't use

Session Behavior

OAuth sessions in Alpha:

Troubleshooting

"Access Denied"

This may mean:

1. You cancelled the authorization on the provider's consent screen
2. The OAuth configuration needs attention

Try signing in again and approving the consent prompt.

"Invalid State" / Expired Flow

The sign-in flow must be completed within 10 minutes of starting it:

1. Return to the Alpha sign-in page
2. Start the OAuth flow again
3. Complete the provider sign-in promptly

Wrong Account Linked

Linking is based on email address:

1. Make sure your provider account uses the same email as your Alpha account
2. If the emails differ, a separate Alpha account is created instead

Removing OAuth Access

You can revoke Alpha's access from the provider side:

From GitHub

1. Go to GitHub Applications settings
2. Open Authorized OAuth Apps
3. Find Alpha Platform
4. Click Revoke

From Microsoft

1. Go to My Apps or your Microsoft account's privacy settings
2. Find Alpha Platform under apps with account access
3. Remove its access

Related