Sign in with Google and GitHub

You can now sign in to Nionx Cloud with Google or GitHub. One click, no new password to remember. Here's how it works, and the few places where I chose safety over convenience.

A popup on your computer, a page on your phone

On a laptop or desktop, “Continue with Google” opens a small window. You approve there, the window closes by itself, and you're in. The page you were on never goes anywhere.

On a phone, popups open as separate tabs and are easy to lose, so there the whole page goes to Google or GitHub and comes back. If your browser blocks popups, the same thing happens on a computer.

If something goes wrong (you cancel, or the account isn't invited yet) you land back on the sign-in page with a sentence saying what happened, not a code.

Still invite-only

Nionx Cloud is in closed beta, and signing in with Google or GitHub doesn't get around that. A new account goes through exactly the same invitation check as signing up with an email: use the Google or GitHub account whose email your invitation was sent to.

Connect them to the account you already have

If you signed up with an email and password, you can add Google or GitHub under Account → Authentication → Sign-in methods, and remove them again.

• It asks you to confirm it's you first, with your password and two-factor code. A connected Google or GitHub account is a permanent way in, so someone who found your laptop open shouldn't be able to quietly add their own.
• You can't remove your last way to sign in, so you can't lock yourself out by accident.
• The emails don't have to match when you connect one yourself, since you're signed in and have just confirmed it's you. When you sign in for the first time, though, a Google or GitHub login only joins an existing Nionx account if both emails are the same and verified. That stops someone from claiming your account by signing up with your email first.

What Nionx asks for

Only your name, email address and profile picture: read:user and user:email on GitHub, the basic profile on Google. Nothing about your repositories, your files or your mail. Every sign-in uses PKCE and a one-time state check, so an approval can't be replayed or hijacked on the way back.

A short outage while setting it up

I'll be honest about this one: while adding the GitHub keys today, the API was down for a few minutes. I had added one of the two keys, and my configuration check treated “half a sign-in provider” as a broken setup and refused to start at all. That was too strict for something optional. Now a provider that isn't fully set up is simply switched off, and everything else keeps running. The status page is there so problems like this are never hidden.

Benji