Accounts, Login, and Access Paths

AI GO has no single front door. Where you come in depends on what you're doing. This chapter clarifies the access path for each kind of identity, plus how accounts are created and recovered.

Identify which kind of user you are

That last row is easy to miss: if your goal is to connect AI GO to an existing system, what you need is an API key, not a login. See Chapter 11.

Organization member accounts

How they're created

Administrators invite members from Member Management in the Dashboard. The invitee receives an activation email and sets a password through the link.

Activation links expire. If yours has expired, ask your administrator to resend it — clicking an expired invitation is the single most common entry problem, and the system says so explicitly rather than failing silently.

Password requirements

• At least 8 characters
• Must include uppercase, lowercase, a digit, and a special character

Google Single Sign-On

If your organization has configured SSO under Organization & Access Control › Single Sign-On, members can sign in with Google instead.

This uses a bring-your-own OAuth client model — your own Google Cloud project credentials, with account binding keyed on Google's stable user identifier. Configuring it requires the system.tenant_settings permission.

Deactivation and offboarding

Administrators can deactivate a member directly from Member Management without deleting the account. A deactivated member cannot log in anywhere — including Custom Apps — while their history and related records remain intact.

Workspace names

Each organization has a workspace name used to construct its dedicated URLs. Once chosen it is retained long-term, and it is protected in three ways:

• Globally unique across organizations
• Reserved words blocked — admin, api, www, login, and similar cannot be used
• Impersonation detection — visually confusable substitutions across writing systems (for example Cyrillic characters mimicking Latin ones) are detected and rejected, blocking names crafted to impersonate another organization or the platform itself

If you've forgotten your organization's workspace name, the login page offers a "forgot workspace" flow that emails you a reminder.

Custom App users

Internal apps

Internal app users are organization members — no separate registration. Open the URL your administrator gave you and sign in with your organization account. If you're already signed in to another AI GO app in the same organization, you'll usually be carried straight through.

What you can see and do inside an internal app is determined by your roles. Applications can read the current user's roles and permission tags and show or hide functionality accordingly.

External apps

External apps have their own user system, entirely separate from organization member accounts. External users (customers, suppliers, partners) register themselves or are created by an administrator.

Administrative capabilities:

• Manage the app's users from the Users tab in the Builder
• Change a user's email address
• Reset a user's password on their behalf

Self-service:

• Users can change their own password without administrator involvement

Troubleshooting

Forgotten password

Click "forgot password" on the login page and enter your registered email. The reset link lands on your organization's dedicated URL — click it directly rather than editing the address.

Locked account

Five consecutive failed password attempts trigger a 15-minute lockout as brute-force protection. It clears automatically; an administrator can also help.

"An invitation link is required"

Opening the registration page on an organization URL without a valid invitation will not render the "register a new team" form — that would create a second organization by mistake. Ask your administrator for an invitation link.

Repeatedly redirected to onboarding

This means initial account setup was never completed. Walking through the setup form once resolves it. If it recurs, contact platform support.

For third-party systems: API keys

If you're connecting a system rather than a person, the path is entirely different:

1. An administrator creates an Integration in the Dashboard
2. They generate an API key for it (prefixed sk_live_, shown exactly once)
3. The third-party system sends it as an X-API-Key header on every request

The API key carries its own application and organization identity — nothing else needs to be passed. One integration can hold several keys (production and staging, say), each revocable independently.

Full walkthrough in Chapter 11.